mcp-for-i 0.1.13 → 0.3.0

package/dist/mcp/tools.js

@@ -1,10 +1,20 @@
+import { AsyncLocalStorage } from "async_hooks";
+import { findToolModule, notifyModulesOfDisconnect, toolModules } from "./modules/index.js";
+import { withAnnotations } from "./annotations.js";
+import { runActionTool } from "./modules/compile.js";
+import { parseEvfevent } from "../ibmi/evfevent.js";
 import { LocalLanguageActions } from "../ibmi/LocalLanguageActions.js";
-import { CompileTools } from "../ibmi/CompileTools.js";
 import { Search } from "../ibmi/Search.js";
+import { ibmDocs } from "../ibmi/IbmDocs.js";
+import { detectSourceLanguage, inspectSource } from "../ibmi/sourceInspect.js";
 import { Tools } from "../ibmi/Tools.js";
+import { checkReadOnlySql, getSqlStatementType as parseSqlStatementType } from "../ibmi/sqlParse.js";
 import { ConnectionService } from "../controlplane/connectionService.js";
 import { log } from "./logger.js";
+import { assertAgentConnectionChangeAllowed, assertSafeIfsDeletePath, checkClCommand, checkClCommands, checkResourcePolicy, checkShellCommand, checkSqlEmbeddedCl, clStartsShell, isShellOperation } from "./policy.js";
+import { configuredLocalRoots, resolveAllowedLocalPath } from "../security/localPaths.js";
 import { exportAuditRecords, listAuditRecords, purgeAuditRecords, verifyAuditChain } from "./audit.js";
+import { gitChangedFiles, normalizeDeployMethod, normalizeDeploySelection, sha256LocalFile, sha256RemoteFiles } from "./deployMethods.js";
 import fs from "fs/promises";
 import path from "path";
 import crypto from "crypto";
@@ -39,7 +49,14 @@ const SETTINGS_SCHEMA = {
         autoClearTempData: { type: "boolean" },
         sourceFileCCSID: { type: "string" },
         sqlJobCcsid: { type: ["string", "number"] },
+        sqlTransport: { type: "string", enum: ["auto", "mapepire", "qzdfmdb2"] },
+        mapepireMode: { type: "string", enum: ["auto", "daemon", "ssh"] },
+        mapepirePort: { type: "number" },
+        mapepireServerPath: { type: "string" },
+        mapepireJavaPath: { type: "string" },
         enableSourceDates: { type: "boolean" },
+        sourceReadMaxBytes: { type: "number" },
+        sourceReadMaxLines: { type: "number" },
         homeDirectory: { type: "string" },
         libraryList: { type: "array", items: { type: "string" } },
         currentLibrary: { type: "string" },
@@ -50,20 +67,14 @@ const SETTINGS_SCHEMA = {
         debugSepPort: { type: "number" },
         sessionIdleMinutes: { type: "number" },
         sessionPingSeconds: { type: "number" },
-        sessionReconnectAttempts: { type: "number" }
-    }
-};
-const POLICY_SCHEMA = {
-    type: "object",
-    properties: {
-        profile: { type: "string", enum: ["read-only", "guarded", "power-user"] },
-        requireApprovalFor: { type: "array", items: { type: "string" } },
-        allowCommands: { type: "array", items: { type: "string" } },
-        denyCommands: { type: "array", items: { type: "string" } },
-        allowLibraries: { type: "array", items: { type: "string" } },
-        denyLibraries: { type: "array", items: { type: "string" } },
-        allowPaths: { type: "array", items: { type: "string" } },
-        denyPaths: { type: "array", items: { type: "string" } }
+        sessionReconnectAttempts: { type: "number" },
+        tn5250Port: { type: "number", description: "TN5250 telnet port (default 23, or 992 when tn5250Tls is true)." },
+        tn5250Tls: { type: "boolean", description: "Use TLS for TN5250 sessions (default true when the port is 992)." },
+        tn5250DeviceName: { type: "string", description: "Virtual device name requested for TN5250 sessions." },
+        tn5250Ccsid: { type: "number", description: "Single-byte EBCDIC code page for TN5250 screen text (default 37)." },
+        tn5250LiveView: { type: "boolean", description: "Serve the live 5250 view on localhost (default true)." },
+        tn5250LiveViewPort: { type: "number", description: "Preferred port for the live 5250 view (default 3981; another free port if taken, 0 for any)." },
+        tn5250AttnWaitMs: { type: "number", description: "How long Attn/SysReq wait for the host before unlocking the keyboard, in ms (default 2000)." }
     }
 };
 const ACTION_SCHEMA = {
@@ -87,13 +98,32 @@ const PROFILE_SCHEMA = {
         name: { type: "string" },
         currentLibrary: { type: "string" },
         libraryList: { type: "array", items: { type: "string" } },
-        customVariables: { type: "array", items: CUSTOM_VARIABLE_SCHEMA }
+        customVariables: { type: "array", items: CUSTOM_VARIABLE_SCHEMA },
+        setLibraryListCommand: { type: "string", description: "CL command run by ibmi.libl.runProfileCommand to set the library list." }
     },
     required: ["name"]
 };
-const tn5250Sessions = new Map();
-const TN5250_MAX_LINES = 30;
-const TN5250_MAX_HISTORY = 20;
+const LINE_RANGE_SCHEMA = {
+    type: "object",
+    properties: {
+        start: { type: "number" },
+        end: { type: "number" }
+    },
+    required: ["start", "end"]
+};
+const SOURCE_INSPECTION_OPERATION_SCHEMA = {
+    type: "object",
+    properties: {
+        operation: { type: "string", enum: ["metadata", "outline", "search", "read_ranges", "dependencies"] },
+        query: { type: "string" },
+        terms: { type: "array", items: { type: "string" } },
+        ranges: { type: "array", items: LINE_RANGE_SCHEMA },
+        before: { type: "number" },
+        after: { type: "number" },
+        maxMatches: { type: "number" }
+    },
+    required: ["operation"]
+};
 export function getTools() {
     const tools = [
         {
@@ -133,6 +163,15 @@ export function getTools() {
             description: "Terminate a session.",
             inputSchema: { type: "object", properties: { connectionName: { type: "string" } } }
         },
+        {
+            name: "ibmi.session.bootstrap",
+            description: "Return connection, IBM i release, library-list, policy, and transport capabilities in one call.",
+            inputSchema: {
+                type: "object",
+                properties: { connectionName: { type: "string" } },
+                required: ["connectionName"]
+            }
+        },
         {
             name: "ibmi.connections.list",
             description: "List saved IBM i connections.",
@@ -140,7 +179,7 @@ export function getTools() {
         },
         {
             name: "ibmi.connections.add",
-            description: "Add a saved IBM i connection (credentials are managed via local control-plane UI).",
+            description: "Add a saved IBM i connection (credentials are managed via local control-plane UI). The policy and the safety settings (readOnlyMode, tempDir, tempLibrary, autoClearTempData, mapepire*) can only be set in the web UI or config.json.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -149,8 +188,7 @@ export function getTools() {
                     port: { type: "number", default: 22 },
                     username: { type: "string" },
                     privateKeyPath: { type: "string" },
-                    settings: SETTINGS_SCHEMA,
-                    policy: POLICY_SCHEMA
+                    settings: SETTINGS_SCHEMA
                 },
                 required: ["name", "host", "username"],
                 additionalProperties: false
@@ -158,7 +196,7 @@ export function getTools() {
         },
         {
             name: "ibmi.connections.update",
-            description: "Update a saved IBM i connection (credentials are managed via local control-plane UI).",
+            description: "Update a saved IBM i connection (credentials are managed via local control-plane UI). The policy and the safety settings (readOnlyMode, tempDir, tempLibrary, autoClearTempData, mapepire*) can only be changed in the web UI or config.json.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -167,8 +205,7 @@ export function getTools() {
                     port: { type: "number" },
                     username: { type: "string" },
                     privateKeyPath: { type: "string" },
-                    settings: SETTINGS_SCHEMA,
-                    policy: POLICY_SCHEMA
+                    settings: SETTINGS_SCHEMA
                 },
                 required: ["name"],
                 additionalProperties: false
@@ -214,25 +251,56 @@ export function getTools() {
             description: "List members in a source file.",
             inputSchema: {
                 type: "object",
-                properties: { library: { type: "string" }, sourceFile: { type: "string" } },
+                properties: {
+                    connectionName: { type: "string" },
+                    library: { type: "string" },
+                    sourceFile: { type: "string" },
+                    member: { type: "string" },
+                    memberPrefix: { type: "string" },
+                    memberContains: { type: "string" },
+                    sourceTypes: { type: "array", items: { type: "string" } },
+                    changedSince: { type: "string" },
+                    limit: { type: "number" },
+                    cursor: { type: "string" },
+                    responseFormat: { type: "string", enum: ["legacy-array", "page"] }
+                },
                 required: ["library", "sourceFile"]
             }
         },
         {
             name: "ibmi.qsys.members.read",
-            description: "Read a member.",
+            description: "Read a member. Full reads larger than the sourceReadMaxBytes/sourceReadMaxLines settings fail with SOURCE_TOO_LARGE; use startLine/endLine, ranges, ibmi.search.members or ibmi.source.inspect instead. startLine without endLine reads to the end of the member.",
             inputSchema: {
                 type: "object",
-                properties: { library: { type: "string" }, sourceFile: { type: "string" }, member: { type: "string" } },
+                properties: {
+                    connectionName: { type: "string" },
+                    library: { type: "string" },
+                    sourceFile: { type: "string" },
+                    member: { type: "string" },
+                    startLine: { type: "number" },
+                    endLine: { type: "number" },
+                    ranges: { type: "array", items: LINE_RANGE_SCHEMA },
+                    before: { type: "number" },
+                    after: { type: "number" },
+                    metadataOnly: { type: "boolean" },
+                    expectedVersion: { type: "string" },
+                    expectedSha256: { type: "string" },
+                    forceFresh: { type: "boolean" },
+                    responseFormat: { type: "string", enum: ["text", "structured"] }
+                },
                 required: ["library", "sourceFile", "member"]
             }
         },
         {
             name: "ibmi.qsys.members.write",
-            description: "Write a member.",
+            description: "Write a member. Pass expectedVersion or expectedSha256 from a structured read to reject the write (VERSION_CONFLICT error) if the member changed. With a version check or responseFormat \"structured\" the result carries the new version and sha256 for chaining edits.",
             inputSchema: {
                 type: "object",
-                properties: { library: { type: "string" }, sourceFile: { type: "string" }, member: { type: "string" }, content: { type: "string" } },
+                properties: {
+                    connectionName: { type: "string" }, library: { type: "string" }, sourceFile: { type: "string" }, member: { type: "string" }, content: { type: "string" },
+                    expectedVersion: { type: "string" }, expectedSha256: { type: "string" },
+                    responseFormat: { type: "string", enum: ["text", "structured"] }
+                },
                 required: ["library", "sourceFile", "member", "content"]
             }
         },
@@ -284,8 +352,16 @@ export function getTools() {
         },
         {
             name: "ibmi.ifs.read",
-            description: "Read an IFS file.",
-            inputSchema: { type: "object", properties: { path: { type: "string" } }, required: ["path"] }
+            description: "Read an IFS file. Text is returned as-is; files that are not valid UTF-8 text are returned base64-encoded. Files larger than maxBytes are refused (use ibmi.ifs.download).",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    path: { type: "string" },
+                    maxBytes: { type: "number", description: "Maximum file size to read (default 1048576, max 16777216)." },
+                    encoding: { type: "string", enum: ["auto", "utf8", "base64"], default: "auto" }
+                },
+                required: ["path"]
+            }
         },
         {
             name: "ibmi.ifs.write",
@@ -299,8 +375,16 @@ export function getTools() {
         },
         {
             name: "ibmi.ifs.delete",
-            description: "Delete an IFS file or directory.",
-            inputSchema: { type: "object", properties: { path: { type: "string" }, recursive: { type: "boolean" } }, required: ["path"] }
+            description: "Delete an IFS file or directory. A recursive delete needs confirmPath equal to path and is refused for paths less than three levels deep (for example /home/USER).",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    path: { type: "string" },
+                    recursive: { type: "boolean" },
+                    confirmPath: { type: "string", description: "Required with recursive=true: repeat the exact path to confirm the delete." }
+                },
+                required: ["path"]
+            }
         },
         {
             name: "ibmi.ifs.upload",
@@ -314,16 +398,93 @@ export function getTools() {
         },
         {
             name: "ibmi.search.members",
-            description: "Search in source members.",
+            description: "Search in source members. Returns at most maxMatches matching lines (default 100, maximum 1000) and reports truncated: true when more exist. Lines are marked kind \"match\" or \"context\".",
             inputSchema: {
                 type: "object",
                 properties: {
+                    connectionName: { type: "string" },
                     library: { type: "string" },
                     sourceFile: { type: "string" },
                     term: { type: "string" },
-                    members: { type: ["string", "array"], items: { type: "string" } }
+                    terms: { type: "array", items: { type: "string" } },
+                    members: { type: ["string", "array"], items: { type: "string" } },
+                    caseSensitive: { type: "boolean" },
+                    before: { type: "number" },
+                    after: { type: "number" },
+                    maxMatches: { type: "number" }
+                },
+                required: ["library", "sourceFile"]
+            }
+        },
+        {
+            name: "ibmi.source.resolve",
+            description: "Resolve an exact source member across candidate source files without listing every member.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    connectionName: { type: "string" },
+                    library: { type: "string" },
+                    member: { type: "string" },
+                    candidateSourceFiles: { type: "array", items: { type: "string" } },
+                    sourceTypes: { type: "array", items: { type: "string" } },
+                    limit: { type: "number" }
                 },
-                required: ["library", "sourceFile", "term"]
+                required: ["connectionName", "library", "member"]
+            }
+        },
+        {
+            name: "ibmi.source.inspect",
+            description: "Resolve and inspect one source member with batched metadata, outline, search, ranges, and dependency operations.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    connectionName: { type: "string" },
+                    library: { type: "string" },
+                    sourceFile: { type: "string" },
+                    member: { type: "string" },
+                    candidateSourceFiles: { type: "array", items: { type: "string" } },
+                    sourceTypes: { type: "array", items: { type: "string" } },
+                    operations: { type: "array", items: SOURCE_INSPECTION_OPERATION_SCHEMA },
+                    expectedVersion: { type: "string" },
+                    expectedSha256: { type: "string" },
+                    forceFresh: { type: "boolean" }
+                },
+                required: ["connectionName", "library", "member", "operations"]
+            }
+        },
+        {
+            name: "ibmi.docs.search",
+            description: "Search the release-aware catalog and cache of official IBM i documentation.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    query: { type: "string" },
+                    connectionName: { type: "string" },
+                    releases: { type: "array", items: { type: "string" } },
+                    categories: { type: "array", items: { type: "string" } },
+                    limit: { type: "number" },
+                    cursor: { type: "string" },
+                    freshness: { type: "string", enum: ["indexed", "prefer-live"] }
+                },
+                required: ["query"]
+            }
+        },
+        {
+            name: "ibmi.docs.open",
+            description: "Open and cache an official IBM documentation page: a ref from ibmi.docs.search or any https://www.ibm.com/docs/ URL. Cached copies expire after 7 days by default.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    ref: { type: "string" },
+                    url: { type: "string" },
+                    expectedVersion: { type: "string" },
+                    requireLive: { type: "boolean" },
+                    freshness: { type: "string", enum: ["allow-cached", "require-live"] },
+                    section: { type: "string" },
+                    startLine: { type: "number" },
+                    endLine: { type: "number" },
+                    maxCharacters: { type: "number" }
+                }
             }
         },
         {
@@ -343,20 +504,32 @@ export function getTools() {
         },
         {
             name: "ibmi.actions.run",
-            description: "Run an action.",
+            description: "Run an action (for example a compile) against a source member or an IFS streamfile. " +
+                "Member targets set &OPENLIB/&OPENSPF/&OPENMBR/&EXT/&NAME; streamfile targets set &FULLPATH/&RELATIVEPATH/&NAME/&EXT. " +
+                "When the command uses OPTION(*EVENTF) the EVFEVENT file is read and errors are returned grouped by file with line, column, severity and message id. " +
+                "Honours the action's deployFirst (with localWorkspace + remoteWorkspace), postDownload (to downloadTo or localWorkspace) and outputToFile. " +
+                "Set includeListing to also return the compile listing spooled file.",
             inputSchema: {
                 type: "object",
                 properties: {
                     actionName: { type: "string" },
                     action: ACTION_SCHEMA,
                     targetType: { type: "string", enum: ["member", "streamfile", "file"] },
-                    targetPath: { type: "string" },
+                    targetPath: { type: "string", description: "Streamfile: absolute IFS path. Member: LIB/FILE/MEMBER[.TYPE] (or use library/sourceFile/member)." },
                     library: { type: "string" },
                     sourceFile: { type: "string" },
                     member: { type: "string" },
-                    extension: { type: "string" }
+                    extension: { type: "string", description: "Member type (looked up when omitted) or streamfile extension." },
+                    cwd: { type: "string", description: "Remote working directory for streamfile actions (default remoteWorkspace, then the home directory)." },
+                    localWorkspace: { type: "string", description: "Local project folder, used by deployFirst, postDownload and relative outputToFile paths." },
+                    remoteWorkspace: { type: "string", description: "IFS folder the local workspace deploys to." },
+                    downloadTo: { type: "string", description: "Local folder for postDownload outputs (default localWorkspace)." },
+                    evfeventLibrary: { type: "string", description: "Override the EVFEVENT library (default: the compiled object's library)." },
+                    evfeventMember: { type: "string", description: "Override the EVFEVENT member (default: the compiled object's name)." },
+                    includeListing: { type: "boolean", description: "Also return the compile listing spooled file." },
+                    listingMaxLines: { type: "number" }
                 },
-                required: ["targetType", "targetPath"]
+                required: ["targetType"]
             }
         },
         {
@@ -534,20 +707,30 @@ export function getTools() {
         },
         {
             name: "ibmi.deploy.compare",
-            description: "Compare local and remote directories (by relative paths).",
-            inputSchema: { type: "object", properties: { localPath: { type: "string" }, remotePath: { type: "string" } }, required: ["localPath", "remotePath"] }
+            description: "Compare local and remote directories (by relative paths). method \"all\" compares sizes; method \"changed\" also compares SHA-256 content hashes of files present on both sides.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    localPath: { type: "string" },
+                    remotePath: { type: "string" },
+                    method: { type: "string", enum: ["all", "changed"], default: "all" }
+                },
+                required: ["localPath", "remotePath"]
+            }
         },
         {
             name: "ibmi.deploy.sync",
-            description: "Sync local directory to remote (upload missing or overwrite).",
+            description: "Sync a local directory to the IFS. method: \"all\" (default) uploads missing files and, with overwrite, size-changed ones; \"changed\" uploads only files whose SHA-256 differs or that are missing remotely; \"gitChanged\" uploads staged, unstaged and untracked files from git status; \"selection\" uploads the listed files (paths relative to localPath). Reports uploaded, unchanged and skipped counts.",
             inputSchema: {
                 type: "object",
                 properties: {
                     localPath: { type: "string" },
                     remotePath: { type: "string" },
-                    overwrite: { type: "boolean", default: false },
+                    method: { type: "string", enum: ["all", "changed", "gitChanged", "selection"], default: "all" },
+                    files: { type: "array", items: { type: "string" }, description: "Relative file paths for method \"selection\"." },
+                    overwrite: { type: "boolean", default: false, description: "method \"all\" only: also upload files whose size differs." },
                     dryRun: { type: "boolean", default: false },
-                    deleteExtraRemote: { type: "boolean", default: false }
+                    deleteExtraRemote: { type: "boolean", default: false, description: "methods \"all\" and \"changed\" only." }
                 },
                 required: ["localPath", "remotePath"]
             }
@@ -600,7 +783,7 @@ export function getTools() {
         },
         {
             name: "ibmi.diagnostics.parseEvfevent",
-            description: "Parse EVFEVENT text into structured diagnostics.",
+            description: "Parse EVFEVENT (compiler events file) records into errors grouped by source file, with line, column, severity and message id. Errors in SQL precompiler temp files are mapped back to the original source.",
             inputSchema: { type: "object", properties: { content: { type: "string" } }, required: ["content"] }
         },
         {
@@ -610,8 +793,18 @@ export function getTools() {
         },
         {
             name: "ibmi.spool.list",
-            description: "List spool file entries.",
-            inputSchema: { type: "object", properties: { connectionName: { type: "string" }, limit: { type: "number" } } }
+            description: "List spool file entries, newest first, optionally filtered by user, output queue or job.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    connectionName: { type: "string" },
+                    limit: { type: "number" },
+                    userName: { type: "string", description: "User profile that owns the spooled files." },
+                    outputQueue: { type: "string", description: "Output queue name." },
+                    outputQueueLibrary: { type: "string", description: "Output queue library." },
+                    jobName: { type: "string", description: "Qualified job name (number/user/name) or a simple job name." }
+                }
+            }
         },
         {
             name: "ibmi.spool.read",
@@ -878,14 +1071,15 @@ export function getTools() {
         },
         {
             name: "ibmi.dataqueue.receive",
-            description: "Receive (or peek) an entry from a data queue.",
+            description: "Peek at (default) or receive an entry from a data queue. remove=true takes the entry off the queue and needs a writable connection.",
             inputSchema: {
                 type: "object",
                 properties: {
                     library: { type: "string" },
                     queue: { type: "string" },
-                    waitSeconds: { type: "number", default: 0 },
-                    remove: { type: "boolean", default: true },
+                    waitSeconds: { type: "number", default: 0, description: "Seconds to wait for an entry (0 to 60)." },
+                    remove: { type: "boolean", default: false },
+                    approve: { type: "boolean", description: "Only used when the connection's approvalMode is \"agent\" (remove=true). By default the user is asked to confirm." },
                     connectionName: { type: "string" }
                 },
                 required: ["library", "queue"]
@@ -985,7 +1179,7 @@ export function getTools() {
         },
         {
             name: "ibmi.journal.entries.query",
-            description: "Read normalized entries from a journal.",
+            description: "Read normalized journal entries, newest first. Filters are applied on the IBM i before the row limit.",
             inputSchema: {
                 type: "object",
                 properties: {
@@ -993,6 +1187,7 @@ export function getTools() {
                     journal: { type: "string" },
                     objectLibrary: { type: "string" },
                     objectName: { type: "string" },
+                    objectType: { type: "string", description: "Object type for the object filter (default *FILE)." },
                     journalCode: { type: "string" },
                     entryType: { type: "string" },
                     userName: { type: "string" },
@@ -1158,57 +1353,25 @@ export function getTools() {
                     connectionName: { type: "string" }
                 }
             }
-        },
-        {
-            name: "ibmi.tn5250.connect",
-            description: "Connect to a TN5250 command session.",
-            inputSchema: { type: "object", properties: { connectionName: { type: "string" } } }
-        },
-        {
-            name: "ibmi.tn5250.readScreen",
-            description: "Read TN5250 screen model.",
-            inputSchema: { type: "object", properties: { connectionName: { type: "string" } } }
-        },
-        {
-            name: "ibmi.tn5250.setField",
-            description: "Set TN5250 field value.",
-            inputSchema: {
-                type: "object",
-                properties: { fieldId: { type: "string" }, value: { type: "string" }, connectionName: { type: "string" } },
-                required: ["fieldId", "value"]
-            }
-        },
-        {
-            name: "ibmi.tn5250.sendKeys",
-            description: "Send TN5250 keys.",
-            inputSchema: {
-                type: "object",
-                properties: { keys: { type: "string" }, timeoutMs: { type: "number" }, connectionName: { type: "string" }, approve: { type: "boolean" } },
-                required: ["keys"]
-            }
-        },
-        {
-            name: "ibmi.tn5250.waitFor",
-            description: "Wait for TN5250 text condition.",
-            inputSchema: { type: "object", properties: { text: { type: "string" }, timeoutMs: { type: "number" }, connectionName: { type: "string" } } }
-        },
-        {
-            name: "ibmi.tn5250.snapshot",
-            description: "Capture TN5250 snapshot.",
-            inputSchema: { type: "object", properties: { connectionName: { type: "string" } } }
-        },
-        {
-            name: "ibmi.tn5250.disconnect",
-            description: "Disconnect TN5250 session.",
-            inputSchema: { type: "object", properties: { connectionName: { type: "string" } } }
         }
     ];
-    return tools
+    return [...tools, ...toolModules.flatMap(module => module.tools)]
         .map(withGuardedApprovalHint)
-        .map(withStrictInputSchema);
+        .map(withSourceConnectionName)
+        .map(withStrictInputSchema)
+        .map(withAnnotations);
 }
+/** The outermost tool call being handled, so confirmation prompts can name it. */
+const toolCallStore = new AsyncLocalStorage();
 export async function handleTool(ctx, name, args) {
+    if (!toolCallStore.getStore()) {
+        return toolCallStore.run({ toolName: name }, () => handleTool(ctx, name, args));
+    }
     const connections = new ConnectionService(ctx.store);
+    await enforceResourcePolicy(ctx, name, args);
+    const toolModule = findToolModule(name);
+    if (toolModule)
+        return toolModule.handle(ctx, name, args);
     switch (name) {
         case "ibmi.connect": {
             if (!args?.name)
@@ -1222,12 +1385,7 @@ export async function handleTool(ctx, name, args) {
         case "ibmi.disconnect": {
             const name = args?.connectionName || ctx.activeName;
             await ctx.disconnect(args?.connectionName);
-            if (name) {
-                tn5250Sessions.delete(name);
-            }
-            else {
-                tn5250Sessions.clear();
-            }
+            notifyModulesOfDisconnect(name);
             return result("Disconnected");
         }
         case "ibmi.session.list": {
@@ -1242,21 +1400,57 @@ export async function handleTool(ctx, name, args) {
         case "ibmi.session.terminate": {
             const name = args?.connectionName || ctx.activeName;
             await ctx.terminateSession(args?.connectionName);
-            if (name)
-                tn5250Sessions.delete(name);
+            notifyModulesOfDisconnect(name);
             return result("Terminated");
         }
+        case "ibmi.session.bootstrap": {
+            const conn = await ctx.ensureActive(args.connectionName);
+            const system = await readSystemFacts(conn);
+            const config = conn.getConfig();
+            return json({
+                connectionName: conn.currentConnectionName,
+                host: conn.currentHost,
+                systemName: system.systemName,
+                effectiveUser: system.effectiveUser || conn.currentUser,
+                release: system.release,
+                currentLibrary: config.currentLibrary || "QGPL",
+                libraryList: config.libraryList || [],
+                defaultUserLibraries: conn.defaultUserLibraries,
+                ccsid: config.sqlJobCcsid ?? 1208,
+                sourceFileCcsid: config.sourceFileCCSID || "*FILE",
+                policy: ctx.getPolicy(args.connectionName),
+                transports: {
+                    sql: conn.sqlJob?.isOpen?.() ? "MAPEPIRE" : "QZDFMDB2",
+                    sqlJob: conn.sqlJob?.status?.(),
+                    sourceRead: ["sql-member", "cpytostmf"]
+                },
+                remoteFeatures: conn.remoteFeatures,
+                capabilities: {
+                    version: "1",
+                    memberPaging: true,
+                    rangedMemberRead: true,
+                    multiTermSearch: true,
+                    sourceResolve: true,
+                    sourceInspect: true,
+                    optimisticConcurrency: true,
+                    ibmDocs: true
+                },
+                validatedAt: new Date().toISOString()
+            });
+        }
         case "ibmi.connections.list": {
             const list = await connections.list();
             return json(list);
         }
         case "ibmi.connections.add": {
             rejectCredentialArgs(args, "ibmi.connections.add");
+            assertAgentConnectionChangeAllowed("ibmi.connections.add", args);
             await connections.add(args);
             return result(`Connection ${args.name} saved`);
         }
         case "ibmi.connections.update": {
             rejectCredentialArgs(args, "ibmi.connections.update");
+            assertAgentConnectionChangeAllowed("ibmi.connections.update", args);
             await connections.update(args.name, args);
             return result(`Connection ${args.name} updated`);
         }
@@ -1308,47 +1502,100 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.qsys.members.list": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            const data = await conn.content.getMemberList({ library: args.library, sourceFile: args.sourceFile });
+            const data = hasMemberListExtensions(args)
+                ? await conn.content.getMemberListPage({
+                    library: args.library,
+                    sourceFile: args.sourceFile,
+                    member: args.member,
+                    memberPrefix: args.memberPrefix,
+                    memberContains: args.memberContains,
+                    sourceTypes: args.sourceTypes,
+                    changedSince: args.changedSince,
+                    limit: args.limit,
+                    cursor: args.cursor
+                })
+                : await conn.content.getMemberList({ library: args.library, sourceFile: args.sourceFile });
             return json(data);
         }
         case "ibmi.qsys.members.read": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            const content = await conn.content.downloadMemberContent(args.library, args.sourceFile, args.member);
-            return result(content);
+            const limits = sourceReadLimits(conn);
+            if (!hasStructuredMemberReadOptions(args)) {
+                const content = await conn.content.downloadMemberContent(args.library, args.sourceFile, args.member);
+                const tooLarge = sourceTooLarge(content, undefined, limits, args);
+                if (tooLarge)
+                    return tooLarge;
+                return result(content);
+            }
+            const wantsVersionCheck = Boolean(args.expectedVersion || args.expectedSha256);
+            if (args.metadataOnly && !wantsVersionCheck && !args.forceFresh && typeof conn.content.getMemberVersionInfo === "function") {
+                // Metadata-only reads never download content; a validated cached
+                // snapshot supplies sha256/version when one is available.
+                const info = await conn.content.getMemberVersionInfo(args.library, args.sourceFile, args.member);
+                if (info.snapshot)
+                    return json(formatMemberRead(info.snapshot, args, limits));
+                return json(memberMetadataEnvelope(args, info.metadata, info.observedAt));
+            }
+            if (isFullMemberRead(args) && typeof conn.content.getMemberMetadata === "function") {
+                const metadata = await conn.content.getMemberMetadata(args.library, args.sourceFile, args.member);
+                const rows = Number(metadata?.rowCount || 0);
+                if (limits.maxLines > 0 && rows > limits.maxLines) {
+                    return sourceTooLargeError(args, { lineCount: rows, metadata }, limits);
+                }
+            }
+            const snapshot = await conn.content.getMemberSnapshot(args.library, args.sourceFile, args.member, Boolean(args.forceFresh));
+            const conflict = memberVersionConflict(snapshot, args);
+            if (conflict)
+                return conflict;
+            return formatMemberReadResult(snapshot, args, limits);
         }
         case "ibmi.qsys.members.write": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
+            const versionChecked = Boolean(args.expectedVersion || args.expectedSha256);
+            let previous;
+            if (versionChecked) {
+                // Re-read the member fresh immediately before writing. A change made
+                // between this check and the write itself can still slip through;
+                // the host offers no compare-and-swap for source members.
+                previous = await conn.content.getMemberSnapshot(args.library, args.sourceFile, args.member, true);
+                const conflict = memberVersionConflict(previous, args);
+                if (conflict)
+                    return conflict;
+            }
             await conn.content.uploadMemberContent(args.library, args.sourceFile, args.member, args.content);
-            return result("OK");
+            const written = await describeWrittenMember(conn, args, previous);
+            if (versionChecked || args.responseFormat === "structured")
+                return json(written);
+            return { content: [{ type: "text", text: "OK" }], structuredContent: { ok: true, text: "OK", data: written } };
         }
         case "ibmi.qsys.members.create": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             await conn.content.createMember(args.library, args.sourceFile, args.member, args.srctype);
             return result("OK");
         }
         case "ibmi.qsys.members.rename": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             await conn.content.renameMember(args.library, args.sourceFile, args.member, args.newMember);
             return result("OK");
         }
         case "ibmi.qsys.members.delete": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             await conn.content.deleteMember(args.library, args.sourceFile, args.member);
             return result("OK");
         }
         case "ibmi.qsys.sourcefiles.create": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             await conn.content.createSourceFile(args.library, args.sourceFile, args.rcdlen || 112);
             return result("OK");
         }
         case "ibmi.qsys.libraries.create": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             await conn.content.createLibrary(args.library);
             return result("OK");
         }
@@ -1359,48 +1606,159 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.ifs.read": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            const data = await conn.content.downloadStreamfileRaw(args.path);
-            return result(Buffer.from(data).toString("utf8"));
+            const maxBytes = clampNumber(args?.maxBytes, IFS_READ_DEFAULT_MAX_BYTES, 1, IFS_READ_HARD_MAX_BYTES);
+            const encoding = String(args?.encoding || "auto").toLowerCase();
+            if (!["auto", "utf8", "base64"].includes(encoding))
+                throw new Error("encoding must be auto, utf8 or base64");
+            const knownSize = await statIfsFileSize(conn, String(args.path));
+            if (knownSize !== undefined && knownSize > maxBytes) {
+                return toolError(`File is ${knownSize} bytes, which is more than maxBytes (${maxBytes}). Raise maxBytes or use ibmi.ifs.download.`, { path: args.path, size: knownSize, maxBytes });
+            }
+            const data = Buffer.from(await conn.content.downloadStreamfileRaw(args.path));
+            if (data.length > maxBytes) {
+                return toolError(`File is ${data.length} bytes, which is more than maxBytes (${maxBytes}). Raise maxBytes or use ibmi.ifs.download.`, { path: args.path, size: data.length, maxBytes });
+            }
+            const text = encoding === "base64" ? undefined : decodeUtf8Text(data);
+            if (text !== undefined)
+                return result(text);
+            if (encoding === "utf8") {
+                return toolError("File is not valid UTF-8 text; read it with encoding=base64.", { path: args.path, size: data.length });
+            }
+            return json({ path: args.path, size: data.length, encoding: "base64", content: data.toString("base64") });
         }
         case "ibmi.ifs.write": {
             const conn = await ctx.ensureActive(args?.connectionName);
             const op = resolveIfsWriteOperation(args.path);
-            enforceWritable(ctx, conn, op, args);
+            await enforceWritable(ctx, conn, op, args);
             await conn.content.writeStreamfileRaw(args.path, args.content);
             return result("OK");
         }
         case "ibmi.ifs.mkdir": {
             const conn = await ctx.ensureActive(args?.connectionName);
             const op = resolveIfsWriteOperation(args.path);
-            enforceWritable(ctx, conn, op, args);
-            await conn.sendCommand({ command: `mkdir -p ${Tools.escapePath(args.path)}` });
+            await enforceWritable(ctx, conn, op, args);
+            requireCommandSuccess(await conn.sendCommand({ command: `mkdir -p ${Tools.escapePath(args.path)}` }), "mkdir");
             return result("OK");
         }
         case "ibmi.ifs.delete": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "ifs.delete", args);
+            await enforceWritable(ctx, conn, "ifs.delete", args);
+            const deletePath = assertSafeIfsDeletePath(args.path);
+            if (args.recursive) {
+                // A recursive delete removes a whole tree, so it must be deep enough and confirmed.
+                if (deletePath.split("/").filter(Boolean).length < 3) {
+                    throw new Error(`ifs.delete refused: recursive deletes need a path at least three levels deep (${deletePath})`);
+                }
+                if (typeof args.confirmPath !== "string" || args.confirmPath.trim().replace(/\/+$/, "") !== deletePath) {
+                    throw new Error("ifs.delete refused: recursive deletes need confirmPath set to the exact path being deleted");
+                }
+            }
             const flag = args.recursive ? "-rf" : "-f";
-            await conn.sendCommand({ command: `rm ${flag} ${Tools.escapePath(args.path)}` });
+            requireCommandSuccess(await conn.sendCommand({ command: `rm ${flag} ${Tools.escapePath(deletePath)}` }), "rm");
             return result("OK");
         }
         case "ibmi.ifs.upload": {
             const conn = await ctx.ensureActive(args?.connectionName);
             const op = resolveIfsWriteOperation(args.remotePath);
-            enforceWritable(ctx, conn, op, args);
-            await conn.client.putFile(args.localPath, args.remotePath);
+            await enforceWritable(ctx, conn, op, args);
+            const localPath = await guardLocalPath(ctx, args.localPath, "read");
+            await conn.client.putFile(localPath, args.remotePath);
             return result("OK");
         }
         case "ibmi.ifs.download": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            await conn.client.getFile(args.localPath, args.remotePath);
+            const localPath = await guardLocalPath(ctx, args.localPath, "write");
+            await conn.client.getFile(localPath, args.remotePath);
             return result("OK");
         }
         case "ibmi.search.members": {
             const conn = await ctx.ensureActive(args?.connectionName);
             const members = args.members || "*";
-            const data = await Search.searchMembers(conn, args.library, args.sourceFile, args.term, members, false);
+            const terms = normalizeSearchTerms(args);
+            const data = await Search.searchMembersTerms(conn, args.library, args.sourceFile, terms, members, false, {
+                caseSensitive: Boolean(args.caseSensitive),
+                before: args.before,
+                after: args.after,
+                maxMatches: args.maxMatches
+            });
             return json(data);
         }
+        case "ibmi.source.resolve": {
+            const conn = await ctx.ensureActive(args.connectionName);
+            const candidates = await conn.content.resolveMembers({
+                library: args.library,
+                member: args.member,
+                candidateSourceFiles: args.candidateSourceFiles,
+                sourceTypes: args.sourceTypes,
+                limit: args.limit
+            });
+            rankMemberCandidates(candidates, args.candidateSourceFiles);
+            return json({
+                status: candidates.length === 0 ? "not-found" : candidates.length === 1 ? "found" : "ambiguous",
+                library: String(args.library).toUpperCase(),
+                member: String(args.member).toUpperCase(),
+                candidates,
+                returned: candidates.length,
+                observedAt: new Date().toISOString()
+            });
+        }
+        case "ibmi.source.inspect": {
+            const conn = await ctx.ensureActive(args.connectionName);
+            const operations = Array.isArray(args.operations) ? args.operations : [];
+            if (operations.length < 1 || operations.length > 8)
+                throw new Error("Provide between 1 and 8 inspection operations");
+            let sourceFile = args.sourceFile ? String(args.sourceFile).toUpperCase() : "";
+            let resolution;
+            if (!sourceFile) {
+                const candidates = await conn.content.resolveMembers({
+                    library: args.library,
+                    member: args.member,
+                    candidateSourceFiles: args.candidateSourceFiles,
+                    sourceTypes: args.sourceTypes,
+                    limit: 20
+                });
+                rankMemberCandidates(candidates, args.candidateSourceFiles);
+                resolution = {
+                    status: candidates.length === 0 ? "not-found" : candidates.length === 1 ? "found" : "ambiguous",
+                    candidates
+                };
+                if (candidates.length !== 1)
+                    return json(resolution);
+                sourceFile = candidates[0].file;
+            }
+            const snapshot = await conn.content.getMemberSnapshot(args.library, sourceFile, args.member, Boolean(args.forceFresh));
+            const conflict = memberVersionConflict(snapshot, args);
+            if (conflict)
+                return conflict;
+            return json({
+                status: "found",
+                identity: snapshot.identity,
+                version: snapshot.version,
+                sha256: snapshot.sha256,
+                observedAt: snapshot.observedAt,
+                complete: snapshot.complete,
+                transport: snapshot.transport,
+                cacheStatus: snapshot.cacheStatus,
+                warnings: snapshot.warnings,
+                ...(resolution ? { resolution } : {}),
+                results: operations.map((operation) => inspectMemberOperation(snapshot, operation, sourceReadLimits(conn)))
+            });
+        }
+        case "ibmi.docs.search": {
+            let releases = args.releases;
+            if ((!releases || releases.length === 0) && args.connectionName) {
+                const conn = await ctx.ensureActive(args.connectionName);
+                const detected = await readSystemFacts(conn);
+                if (detected.release)
+                    releases = [detected.release];
+            }
+            return json(await ibmDocs.search({ ...args, releases }));
+        }
+        case "ibmi.docs.open": {
+            if (!args.ref && !args.url)
+                throw new Error("ref or url is required");
+            return json(await ibmDocs.open(args));
+        }
         case "ibmi.search.ifs": {
             const conn = await ctx.ensureActive(args?.connectionName);
             const data = await Search.searchIFS(conn, args.path, args.term);
@@ -1423,49 +1781,7 @@ export async function handleTool(ctx, name, args) {
             return json(actions);
         }
         case "ibmi.actions.run": {
-            const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
-            const action = await resolveAction(ctx, args);
-            if (!action)
-                throw new Error("Action not found");
-            const envVars = {};
-            const targetPath = args.targetPath;
-            const targetType = args.targetType;
-            if (targetType === "file") {
-                throw new Error("Local file actions are not supported in this MCP server (use streamfile or member).");
-            }
-            if (targetType === "streamfile") {
-                envVars["&FULLPATH"] = targetPath;
-                const base = targetPath.split("/").pop() || targetPath;
-                envVars["&BASENAME"] = base;
-                envVars["&NAME"] = base.includes(".") ? base.substring(0, base.lastIndexOf(".")) : base;
-                envVars["&EXT"] = base.includes(".") ? base.substring(base.lastIndexOf(".") + 1) : "";
-                envVars["&RELATIVEPATH"] = targetPath;
-            }
-            if (targetType === "member") {
-                const lib = requireQsysName(conn, args.library, "library");
-                const src = requireQsysName(conn, args.sourceFile, "sourceFile");
-                const mbr = requireQsysName(conn, args.member || targetPath.split("/").pop(), "member");
-                const ext = String(args.extension || "");
-                envVars["&LIBRARY"] = lib;
-                envVars["&SRCFILE"] = src;
-                envVars["&NAME"] = mbr;
-                envVars["&EXT"] = ext;
-                envVars["&EXTL"] = ext.toLowerCase();
-                envVars["&FULLPATH"] = `${lib}/${src}/${mbr}`;
-                envVars["&OPENLIB"] = lib;
-                envVars["&OPENLIBL"] = lib.toLowerCase();
-                envVars["&OPENSPF"] = src;
-                envVars["&OPENSPFL"] = src.toLowerCase();
-                envVars["&OPENMBR"] = mbr;
-                envVars["&OPENMBRL"] = mbr.toLowerCase();
-            }
-            const resultCmd = await CompileTools.runCommand(conn, {
-                command: action.command,
-                environment: action.environment,
-                env: envVars
-            });
-            return json(mapActionExecution(action, targetType, targetPath, resultCmd));
+            return runActionTool(ctx, args);
         }
         case "ibmi.actions.save": {
             const action = args.action;
@@ -1499,15 +1815,13 @@ export async function handleTool(ctx, name, args) {
         case "ibmi.libl.set": {
             const name = getConnectionName(ctx, args);
             const active = await ctx.ensureActive(name);
-            enforceWritable(ctx, active, "qsys.write", args);
+            await enforceWritable(ctx, active, "qsys.write", args);
             await updateConnectionSettings(ctx, name, {
                 currentLibrary: args.currentLibrary,
                 libraryList: args.libraryList
             });
-            if (args.applyToJob) {
-                await applyLibraryList(active, args.libraryList, args.currentLibrary);
-            }
-            return result("OK");
+            const applied = args.applyToJob ? await applyLibraryList(active, args.libraryList, args.currentLibrary) : undefined;
+            return okApplied(applied);
         }
         case "ibmi.libl.add": {
             const name = getConnectionName(ctx, args);
@@ -1519,12 +1833,10 @@ export async function handleTool(ctx, name, args) {
             if (!list.includes(lib))
                 list.push(lib);
             const active = await ctx.ensureActive(name);
-            enforceWritable(ctx, active, "qsys.write", args);
+            await enforceWritable(ctx, active, "qsys.write", args);
             await updateConnectionSettings(ctx, name, { libraryList: list });
-            if (args.applyToJob) {
-                await applyLibraryList(active, list, conn.settings?.currentLibrary);
-            }
-            return result("OK");
+            const applied = args.applyToJob ? await applyLibraryList(active, list, conn.settings?.currentLibrary) : undefined;
+            return okApplied(applied);
         }
         case "ibmi.libl.remove": {
             const name = getConnectionName(ctx, args);
@@ -1533,23 +1845,19 @@ export async function handleTool(ctx, name, args) {
                 throw new Error(`Connection ${name} not found`);
             const list = (conn.settings?.libraryList || []).filter(l => l !== String(args.library).toUpperCase());
             const active = await ctx.ensureActive(name);
-            enforceWritable(ctx, active, "qsys.write", args);
+            await enforceWritable(ctx, active, "qsys.write", args);
             await updateConnectionSettings(ctx, name, { libraryList: list });
-            if (args.applyToJob) {
-                await applyLibraryList(active, list, conn.settings?.currentLibrary);
-            }
-            return result("OK");
+            const applied = args.applyToJob ? await applyLibraryList(active, list, conn.settings?.currentLibrary) : undefined;
+            return okApplied(applied);
         }
         case "ibmi.libl.setCurrent": {
             const name = getConnectionName(ctx, args);
             const lib = String(args.library).toUpperCase();
             const active = await ctx.ensureActive(name);
-            enforceWritable(ctx, active, "qsys.write", args);
+            await enforceWritable(ctx, active, "qsys.write", args);
             await updateConnectionSettings(ctx, name, { currentLibrary: lib });
-            if (args.applyToJob) {
-                await applyLibraryList(active, undefined, lib);
-            }
-            return result("OK");
+            const applied = args.applyToJob ? await applyLibraryList(active, undefined, lib) : undefined;
+            return okApplied(applied);
         }
         case "ibmi.libl.validate": {
             const conn = await ctx.ensureActive(args?.connectionName);
@@ -1583,17 +1891,15 @@ export async function handleTool(ctx, name, args) {
             if (!profile)
                 throw new Error(`Profile ${args.name} not found`);
             const active = await ctx.ensureActive(name);
-            enforceWritable(ctx, active, "qsys.write", args);
+            await enforceWritable(ctx, active, "qsys.write", args);
             await ctx.store.setCurrentProfile(name, args.name);
             await updateConnectionSettings(ctx, name, {
                 currentLibrary: profile.currentLibrary,
                 libraryList: profile.libraryList,
                 customVariables: profile.customVariables
             });
-            if (args.applyToJob) {
-                await applyLibraryList(active, profile.libraryList, profile.currentLibrary);
-            }
-            return result(`Profile ${args.name} activated`);
+            const applied = args.applyToJob ? await applyLibraryList(active, profile.libraryList, profile.currentLibrary) : undefined;
+            return okApplied(applied, `Profile ${args.name} activated`);
         }
         case "ibmi.resolve.path": {
             const conn = await ctx.ensureActive(args?.connectionName);
@@ -1615,15 +1921,20 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.deploy.uploadDirectory": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "deploy.sync", args);
-            await conn.client.putDirectory(args.localPath, args.remotePath, { recursive: true, concurrency: 5 });
+            await enforceWritable(ctx, conn, "deploy.sync", args);
+            const localPath = await guardLocalPath(ctx, args.localPath, "read");
+            await conn.client.putDirectory(localPath, args.remotePath, { recursive: true, concurrency: 5 });
             return result("OK");
         }
         case "ibmi.deploy.uploadFiles": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "deploy.sync", args);
+            await enforceWritable(ctx, conn, "deploy.sync", args);
             const remoteDir = String(args.remoteDirectory);
+            const localFiles = [];
             for (const file of args.localFiles || []) {
+                localFiles.push(await guardLocalPath(ctx, file, "read"));
+            }
+            for (const file of localFiles) {
                 const base = String(file).split(/[\\/]/).pop();
                 const remotePath = `${remoteDir}/${base}`;
                 await conn.client.putFile(String(file), remotePath);
@@ -1632,12 +1943,12 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.deploy.setCcsid": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "deploy.sync", args);
+            await enforceWritable(ctx, conn, "deploy.sync", args);
             const setccsid = conn.remoteFeatures.setccsid;
             if (!setccsid)
                 throw new Error("setccsid not available on remote system");
             const ccsid = args.ccsid || "1208";
-            await conn.sendCommand({ command: `${setccsid} -R ${Tools.shellQuote(ccsid)} ${Tools.escapePath(args.remotePath)}` });
+            requireCommandSuccess(await conn.sendCommand({ command: `${setccsid} -R ${Tools.shellQuote(ccsid)} ${Tools.escapePath(args.remotePath)}` }), "setccsid");
             return result("OK");
         }
         case "ibmi.filters.list": {
@@ -1710,46 +2021,90 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.debug.startService": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const submitOptions = `JOBQ(QSYS/QUSRNOMAX) JOBD(QSYS/QSYSJOBD) OUTQ(QUSRSYS/QDBGSRV) USER(QDBGSRV)`;
             const cmd = `QSYS/SBMJOB JOB(QDBGSRV) SYSLIBL(*SYSVAL) CURLIB(*USRPRF) INLLIBL(*JOBD) ${submitOptions} CMD(QSH CMD('/QIBM/ProdData/IBMiDebugService/bin/startDebugService.sh'))`;
             const res = await conn.sendQsh({ command: `system \"${cmd}\"` });
-            return json(res);
+            return commandOutcome({ ok: res.code === 0, ...res });
         }
         case "ibmi.debug.stopService": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const res = await conn.sendCommand({ command: `/QIBM/ProdData/IBMiDebugService/bin/stopDebugService.sh` });
-            return json(res);
+            return commandOutcome({ ok: res.code === 0, ...res });
         }
         case "ibmi.deploy.compare": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            const localPath = String(args.localPath);
+            const localPath = await guardLocalPath(ctx, args.localPath, "read");
             const remotePath = String(args.remotePath);
+            const method = normalizeDeployMethod(args.method);
+            if (method !== "all" && method !== "changed")
+                throw new Error(`deploy.compare supports method "all" or "changed", not "${method}"`);
             const comparison = await compareDeployTrees(conn, localPath, remotePath);
-            return json(comparison);
+            return json(method === "changed" ? await refineComparisonByHash(conn, comparison) : comparison);
         }
         case "ibmi.deploy.sync": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "deploy.sync", args);
-            const localPath = String(args.localPath);
+            await enforceWritable(ctx, conn, "deploy.sync", args);
+            const localPath = await guardLocalPath(ctx, args.localPath, "read");
             const remotePath = String(args.remotePath);
+            const method = normalizeDeployMethod(args.method);
             const overwrite = Boolean(args.overwrite);
             const dryRun = Boolean(args.dryRun);
             const deleteExtraRemote = Boolean(args.deleteExtraRemote);
-            const comparison = await compareDeployTrees(conn, localPath, remotePath);
-            const uploadSet = new Set(comparison.onlyLocal);
-            if (overwrite) {
-                comparison.changed.forEach(entry => uploadSet.add(entry.path));
-                comparison.unresolved.forEach(entry => uploadSet.add(entry.path));
+            if (deleteExtraRemote && (method === "gitChanged" || method === "selection")) {
+                throw new Error(`deleteExtraRemote is only supported with method "all" or "changed"`);
+            }
+            const errors = [];
+            let comparison;
+            let uploadSet;
+            let skipChanged = [];
+            let unresolved = [];
+            let unchanged = [];
+            let gitDeleted = [];
+            if (method === "all" || method === "changed") {
+                comparison = await compareDeployTrees(conn, localPath, remotePath);
+                if (method === "changed")
+                    comparison = await refineComparisonByHash(conn, comparison);
+                uploadSet = new Set(comparison.onlyLocal);
+                // "changed" compared content, so every differing file is uploaded.
+                const includeChanged = overwrite || method === "changed";
+                if (includeChanged) {
+                    comparison.changed.forEach(entry => uploadSet.add(entry.path));
+                    comparison.unresolved.forEach(entry => uploadSet.add(entry.path));
+                }
+                skipChanged = includeChanged ? [] : comparison.changed.map(entry => entry.path).sort((a, b) => a.localeCompare(b));
+                unresolved = includeChanged ? [] : comparison.unresolved.map(entry => entry.path).sort((a, b) => a.localeCompare(b));
+                unchanged = [...comparison.identical];
+            }
+            else if (method === "gitChanged") {
+                const git = await gitChangedFiles(localPath);
+                uploadSet = new Set(git.files);
+                gitDeleted = git.deleted;
+            }
+            else {
+                uploadSet = new Set();
+                for (const rel of normalizeDeploySelection(args.files)) {
+                    try {
+                        const resolved = await guardLocalPath(ctx, path.join(localPath, rel), "read");
+                        const relative = path.relative(localPath, resolved);
+                        if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+                            throw new Error("file is outside localPath");
+                        }
+                        const stat = await fs.stat(resolved).catch(() => undefined);
+                        if (!stat?.isFile())
+                            throw new Error("local file not found");
+                        uploadSet.add(rel);
+                    }
+                    catch (err) {
+                        errors.push({ operation: "upload", path: rel, message: err?.message || String(err) });
+                    }
+                }
             }
             const uploadPlan = Array.from(uploadSet).sort((a, b) => a.localeCompare(b));
-            const skipChanged = overwrite ? [] : comparison.changed.map(entry => entry.path).sort((a, b) => a.localeCompare(b));
-            const unresolved = overwrite ? [] : comparison.unresolved.map(entry => entry.path).sort((a, b) => a.localeCompare(b));
-            const deletePlan = deleteExtraRemote ? [...comparison.onlyRemote] : [];
+            const deletePlan = deleteExtraRemote && comparison ? [...comparison.onlyRemote] : [];
             const uploaded = [];
             const deleted = [];
-            const errors = [];
             if (!dryRun) {
                 const createdDirs = new Set();
                 for (const rel of uploadPlan) {
@@ -1758,7 +2113,7 @@ export async function handleTool(ctx, name, args) {
                     const remoteDir = remoteFile.split("/").slice(0, -1).join("/");
                     try {
                         if (!createdDirs.has(remoteDir)) {
-                            await conn.sendCommand({ command: `mkdir -p ${Tools.escapePath(remoteDir)}` });
+                            requireCommandSuccess(await conn.sendCommand({ command: `mkdir -p ${Tools.escapePath(remoteDir)}` }), "mkdir");
                             createdDirs.add(remoteDir);
                         }
                         await conn.client.putFile(localFile, remoteFile);
@@ -1771,7 +2126,7 @@ export async function handleTool(ctx, name, args) {
                 for (const rel of deletePlan) {
                     const remoteFile = joinRemotePath(remotePath, rel);
                     try {
-                        await conn.sendCommand({ command: `rm -f ${Tools.escapePath(remoteFile)}` });
+                        requireCommandSuccess(await conn.sendCommand({ command: `rm -f ${Tools.escapePath(remoteFile)}` }), "rm");
                         deleted.push(rel);
                     }
                     catch (err) {
@@ -1779,22 +2134,35 @@ export async function handleTool(ctx, name, args) {
                     }
                 }
             }
-            return json({
+            const syncResult = {
                 ok: errors.length === 0,
-                mode: { overwrite, deleteExtraRemote, dryRun },
-                comparison,
+                mode: { method, overwrite, deleteExtraRemote, dryRun },
+                comparison: comparison ?? null,
                 planned: {
                     upload: uploadPlan,
                     delete: deletePlan,
                     skippedChanged: skipChanged,
-                    unresolved
+                    unresolved,
+                    ...(method === "gitChanged" ? { gitDeleted } : {})
                 },
                 applied: {
                     uploaded: dryRun ? [] : uploaded,
                     deleted: dryRun ? [] : deleted
                 },
+                summary: {
+                    planned: uploadPlan.length,
+                    uploaded: dryRun ? 0 : uploaded.length,
+                    unchanged: unchanged.length,
+                    skipped: skipChanged.length + unresolved.length + gitDeleted.length,
+                    deleted: dryRun ? 0 : deleted.length,
+                    failed: errors.length
+                },
                 errors
-            });
+            };
+            if (errors.length > 0) {
+                return jsonError(`deploy.sync finished with ${errors.length} failed operation(s)`, syncResult);
+            }
+            return json(syncResult);
         }
         case "ibmi.sql.query": {
             const conn = await ctx.ensureActive(args?.connectionName);
@@ -1815,10 +2183,14 @@ export async function handleTool(ctx, name, args) {
             if (!args?.sql)
                 throw new Error("sql is required when cursor is not provided");
             const sql = String(args.sql);
-            if (!isReadOnlySql(sql))
-                throw new Error("ibmi.sql.query only supports read-only SQL");
+            const readOnlyCheck = checkReadOnlySql(sql);
+            if (!readOnlyCheck.readOnly)
+                throw new Error(`ibmi.sql.query only supports read-only SQL: ${readOnlyCheck.reason}`);
             const startedAt = Date.now();
-            const rows = await withTimeout(conn.runSQL(sql), timeoutMs, `SQL query timed out after ${timeoutMs}ms`);
+            // Ask for one row more than maxRows so truncation can be reported without
+            // pulling the whole result set over the wire.
+            const capped = applySqlRowCap(sql, maxRows + 1);
+            const rows = await runSqlWithTimeout(conn, capped.sql, timeoutMs, `SQL query timed out after ${timeoutMs}ms`);
             const limited = rows.slice(0, maxRows);
             const firstPage = limited.slice(0, pageSize);
             const cursorInfo = ctx.createSqlCursor(limited, pageSize);
@@ -1828,6 +2200,9 @@ export async function handleTool(ctx, name, args) {
                 cursor: cursorInfo.cursor,
                 totalRows: limited.length,
                 truncated: rows.length > limited.length,
+                ...(rows.length > limited.length
+                    ? { truncationNote: `Result has more than ${maxRows} rows; only the first ${maxRows} are returned. Raise maxRows (up to 20000) or narrow the query.` }
+                    : {}),
                 ...(includeMetadata
                     ? {
                         metadata: {
@@ -1835,6 +2210,7 @@ export async function handleTool(ctx, name, args) {
                             columns: getRowColumns(firstPage),
                             pageSize,
                             maxRows,
+                            rowCapAppliedInSql: capped.applied,
                             timeoutMs,
                             executionMs
                         }
@@ -1844,13 +2220,13 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.sql.execute": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforcePolicyOperation(ctx, "sql.write", args);
+            await enforceWritable(ctx, conn, "sql.write", args);
             const sql = String(args.sql);
             const timeoutMs = clampNumber(args?.timeoutMs, 45000, 1000, 300000);
             const statementType = getSqlStatementType(sql);
             const startedAt = Date.now();
             try {
-                const rows = await withTimeout(conn.runSQL(sql), timeoutMs, `SQL execute timed out after ${timeoutMs}ms`);
+                const rows = await runSqlWithTimeout(conn, sql, timeoutMs, `SQL execute timed out after ${timeoutMs}ms`);
                 const executionMs = Date.now() - startedAt;
                 const affectedRows = inferAffectedRows(rows);
                 log("info", "audit.sql.execute", {
@@ -1883,7 +2259,7 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.cl.run": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforcePolicyOperation(ctx, "cl.run", args);
+            await enforceWritable(ctx, conn, "cl.run", args);
             const command = String(args.command || "");
             if (!command.trim())
                 throw new Error("command is required");
@@ -1905,13 +2281,24 @@ export async function handleTool(ctx, name, args) {
         case "ibmi.joblog.get": {
             const conn = await ctx.ensureActive(args?.connectionName);
             const limit = clampNumber(args?.limit, 200, 1, 5000);
-            const rows = await conn.runSQL(`select message_id, message_text, severity, message_timestamp from table(qsys2.joblog_info('*')) order by message_timestamp desc fetch first ${limit} rows only`);
+            // MCH3401 "Cannot resolve to object PPTT" is logged by the database
+            // machinery on every statement on some systems; it would crowd out the
+            // messages from the user's own SQL and CL.
+            const rows = await conn.runSQL(`select message_id, message_text, severity, message_timestamp from table(qsys2.joblog_info('*')) x ` +
+                `where not (coalesce(message_id, '') = 'MCH3401' and coalesce(message_text, '') like '%PPTT%') ` +
+                `order by message_timestamp desc fetch first ${limit} rows only`);
             return json(rows.map(normalizeJoblogRow));
         }
         case "ibmi.spool.list": {
             const conn = await ctx.ensureActive(args?.connectionName);
             const limit = clampNumber(args?.limit, 200, 1, 5000);
-            const rows = await querySpoolEntries(conn, limit);
+            const rows = await querySpoolEntries(conn, {
+                limit,
+                userName: args?.userName ? requireIbmObjectName(args.userName, "userName") : undefined,
+                outputQueue: args?.outputQueue ? requireIbmObjectName(args.outputQueue, "outputQueue") : undefined,
+                outputQueueLibrary: args?.outputQueueLibrary ? requireIbmObjectName(args.outputQueueLibrary, "outputQueueLibrary") : undefined,
+                jobName: args?.jobName ? requireSpoolJobFilter(args.jobName) : undefined
+            });
             return json(rows.map(normalizeSpoolEntry));
         }
         case "ibmi.spool.read": {
@@ -1920,39 +2307,41 @@ export async function handleTool(ctx, name, args) {
             const jobName = Tools.sqlString(String(args.jobName));
             const fileName = Tools.sqlString(String(args.spooledFileName));
             const fileNbr = clampNumber(args.spooledFileNumber, 1, 1, 999999999);
-            const rows = await conn.runSQL(`select line_number, spooled_data from table(qsys2.display_spooled_file_data(${jobName}, ${fileName}, ${fileNbr})) fetch first ${limit} rows only`);
+            // DISPLAY_SPOOLED_FILE_DATA returns ORDINAL_POSITION and SPOOLED_DATA.
+            const rows = await conn.runSQL(`select ordinal_position, spooled_data from table(qsys2.display_spooled_file_data(${jobName}, ${fileName}, ${fileNbr})) ` +
+                `order by ordinal_position fetch first ${limit} rows only`);
             return json(rows.map(normalizeSpoolLine));
         }
         case "ibmi.spool.hold": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
-            const command = buildSpoolCommand("HLDSPFL", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
+            const command = buildSpoolCommand("HLDSPLF", args);
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({ ok: cmdResult.code === 0, command, ...cmdResult });
+            return commandOutcome({ ok: cmdResult.code === 0, command, ...cmdResult });
         }
         case "ibmi.spool.release": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const command = buildSpoolCommand("RLSSPLF", args);
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({ ok: cmdResult.code === 0, command, ...cmdResult });
+            return commandOutcome({ ok: cmdResult.code === 0, command, ...cmdResult });
         }
         case "ibmi.spool.delete": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const command = buildSpoolCommand("DLTSPLF", args);
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({ ok: cmdResult.code === 0, command, ...cmdResult });
+            return commandOutcome({ ok: cmdResult.code === 0, command, ...cmdResult });
         }
         case "ibmi.spool.move": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const baseCommand = buildSpoolCommand("CHGSPLFA", args);
             const outQueueLibrary = requireIbmObjectName(args.outQueueLibrary, "outQueueLibrary");
             const outQueue = requireIbmObjectName(args.outQueue, "outQueue");
             const command = `${baseCommand} OUTQ(${outQueueLibrary}/${outQueue})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({ ok: cmdResult.code === 0, command, ...cmdResult });
+            return commandOutcome({ ok: cmdResult.code === 0, command, ...cmdResult });
         }
         case "ibmi.jobs.list": {
             const conn = await ctx.ensureActive(args?.connectionName);
@@ -1967,24 +2356,24 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.jobs.hold": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const jobName = requireJobName(args.jobName);
             const hold = Boolean(args?.holdOnJobQueue) ? "*JOBQ" : "*NO";
             const command = `HLDJOB JOB(${jobName}) HOLD(${hold})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({ ok: cmdResult.code === 0, command, ...cmdResult });
+            return commandOutcome({ ok: cmdResult.code === 0, command, ...cmdResult });
         }
         case "ibmi.jobs.release": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const jobName = requireJobName(args.jobName);
             const command = `RLSJOB JOB(${jobName})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({ ok: cmdResult.code === 0, command, ...cmdResult });
+            return commandOutcome({ ok: cmdResult.code === 0, command, ...cmdResult });
         }
         case "ibmi.jobs.end": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const jobName = requireJobName(args.jobName);
             const option = String(args?.option || "*CNTRLD").toUpperCase();
             if (option !== "*CNTRLD" && option !== "*IMMED") {
@@ -1993,7 +2382,7 @@ export async function handleTool(ctx, name, args) {
             const delaySeconds = clampNumber(args?.delaySeconds, 30, 0, 99999);
             const command = `ENDJOB JOB(${jobName}) OPTION(${option}) DELAY(${delaySeconds})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({ ok: cmdResult.code === 0, command, ...cmdResult });
+            return commandOutcome({ ok: cmdResult.code === 0, command, ...cmdResult });
         }
         case "ibmi.subsystems.list": {
             const conn = await ctx.ensureActive(args?.connectionName);
@@ -2014,15 +2403,15 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.subsystems.start": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const subsystemDescription = requireQualifiedObject(args.subsystemDescription, "subsystemDescription");
             const command = `STRSBS SBSD(${subsystemDescription.library}/${subsystemDescription.object})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({ ok: cmdResult.code === 0, command, ...cmdResult });
+            return commandOutcome({ ok: cmdResult.code === 0, command, ...cmdResult });
         }
         case "ibmi.subsystems.end": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const subsystem = requireIbmObjectName(args.subsystem, "subsystem");
             const option = String(args?.option || "*CNTRLD").toUpperCase();
             if (option !== "*CNTRLD" && option !== "*IMMED") {
@@ -2031,7 +2420,7 @@ export async function handleTool(ctx, name, args) {
             const delaySeconds = clampNumber(args?.delaySeconds, 30, 0, 99999);
             const command = `ENDSBS SBS(${subsystem}) OPTION(${option}) DELAY(${delaySeconds})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({ ok: cmdResult.code === 0, command, ...cmdResult });
+            return commandOutcome({ ok: cmdResult.code === 0, command, ...cmdResult });
         }
         case "ibmi.msgq.read": {
             const conn = await ctx.ensureActive(args?.connectionName);
@@ -2043,7 +2432,7 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.msgq.send": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const library = requireIbmObjectName(args?.library || "QSYS", "library");
             const messageQueue = requireIbmObjectName(args?.messageQueue || "QSYSOPR", "messageQueue");
             const messageType = String(args?.messageType || "*INFO").toUpperCase();
@@ -2053,16 +2442,19 @@ export async function handleTool(ctx, name, args) {
             const message = String(args.message || "");
             if (!message.trim())
                 throw new Error("message is required");
-            const mappedMessageType = messageType === "*INQ" ? "*INQ" : "*INFO";
-            const command = mappedMessageType === "*INQ"
-                ? `SNDMSG MSG(${quoteClString(message)}) TOMSGQ(${library}/${messageQueue}) MSGTYPE(*INQ) RPYMSGQ(${library}/${messageQueue})`
-                : `SNDMSG MSG(${quoteClString(message)}) TOMSGQ(${library}/${messageQueue}) MSGTYPE(*INFO)`;
+            const command = buildSendMessageCommand(message, library, messageQueue, messageType);
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({ ok: cmdResult.code === 0, command, requestedMessageType: messageType, mappedMessageType, ...cmdResult });
+            return commandOutcome({
+                ok: cmdResult.code === 0,
+                command,
+                requestedMessageType: messageType,
+                mappedMessageType: messageType,
+                ...cmdResult
+            });
         }
         case "ibmi.msgq.reply": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const library = requireIbmObjectName(args?.library || "QSYS", "library");
             const messageQueue = requireIbmObjectName(args?.messageQueue || "QSYSOPR", "messageQueue");
             const messageKey = requireMessageKey(args.messageKey);
@@ -2071,16 +2463,16 @@ export async function handleTool(ctx, name, args) {
                 throw new Error("reply is required");
             const command = `SNDRPY MSGKEY(${messageKey}) MSGQ(${library}/${messageQueue}) RPY(${quoteClString(reply)})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({ ok: cmdResult.code === 0, command, ...cmdResult });
+            return commandOutcome({ ok: cmdResult.code === 0, command, ...cmdResult });
         }
         case "ibmi.locks.list": {
             const conn = await ctx.ensureActive(args?.connectionName);
             const limit = clampNumber(args?.limit, 200, 1, 5000);
             const rows = await queryLockEntries(conn, {
-                objectLibrary: args?.objectLibrary,
-                objectName: args?.objectName,
-                objectType: args?.objectType,
-                member: args?.member,
+                objectLibrary: args?.objectLibrary ? requireIbmObjectName(args.objectLibrary, "objectLibrary") : undefined,
+                objectName: args?.objectName ? requireIbmObjectName(args.objectName, "objectName") : undefined,
+                objectType: args?.objectType ? requireObjectTypeValue(args.objectType, "objectType") : undefined,
+                member: args?.member ? requireIbmObjectName(args.member, "member") : undefined,
                 limit
             });
             return json(rows);
@@ -2096,14 +2488,16 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.dataqueue.send": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const library = requireIbmObjectName(args.library, "library");
             const queue = requireIbmObjectName(args.queue, "queue");
             const message = String(args.message || "");
             if (!message)
                 throw new Error("message is required");
+            let primaryError;
             try {
-                await conn.runSQL(`call qsys2.send_data_queue(${Tools.sqlString(message)}, ${Tools.sqlString(queue)}, ${Tools.sqlString(library)})`);
+                await conn.runSQL(`call qsys2.send_data_queue(message_data => ${Tools.sqlString(message)}, ` +
+                    `data_queue => ${Tools.sqlString(queue)}, data_queue_library => ${Tools.sqlString(library)})`);
                 return json({
                     ok: true,
                     method: "qsys2.send_data_queue",
@@ -2112,18 +2506,31 @@ export async function handleTool(ctx, name, args) {
                     messageLength: message.length
                 });
             }
-            catch {
-                const command = `SNDDTAQ DTAQ(${library}/${queue}) DTA(${quoteClString(message)})`;
-                const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-                return json({ ok: cmdResult.code === 0, method: "cl.snddtaq", command, ...cmdResult });
+            catch (err) {
+                primaryError = err?.message || String(err);
             }
+            // Older releases without QSYS2.SEND_DATA_QUEUE: call the QSNDDTAQ API.
+            // There is no SNDDTAQ CL command.
+            const command = buildQsnddtaqCall(library, queue, message);
+            const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
+            return commandOutcome({
+                ok: cmdResult.code === 0,
+                method: "api.qsnddtaq",
+                command,
+                primaryError,
+                ...cmdResult
+            });
         }
         case "ibmi.dataqueue.receive": {
             const conn = await ctx.ensureActive(args?.connectionName);
             const library = requireIbmObjectName(args.library, "library");
             const queue = requireIbmObjectName(args.queue, "queue");
-            const waitSeconds = clampNumber(args?.waitSeconds, 0, 0, 999999);
-            const remove = Boolean(args?.remove ?? true);
+            const waitSeconds = clampNumber(args?.waitSeconds, 0, 0, DATA_QUEUE_MAX_WAIT_SECONDS);
+            // Peek by default. Removing an entry changes the queue, so it goes
+            // through the same write gate as the other write tools.
+            const remove = args?.remove === true;
+            if (remove)
+                await enforceWritable(ctx, conn, "qsys.write", args);
             const rows = await queryDataQueueEntries(conn, { library, queue, waitSeconds, remove });
             return json(rows);
         }
@@ -2136,15 +2543,20 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.dataarea.write": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const library = requireIbmObjectName(args.library, "library");
             const dataArea = requireIbmObjectName(args.dataArea, "dataArea");
-            const value = String(args.value || "");
-            const startPosition = clampNumber(args?.startPosition, 1, 1, 2000);
-            const length = clampNumber(args?.length, Math.max(value.length, 1), 1, 2000);
-            const command = `CHGDTAARA DTAARA(${library}/${dataArea} (${startPosition} ${length})) VALUE(${quoteClString(value)})`;
+            const value = String(args.value ?? "");
+            let info;
+            try {
+                info = (await queryDataAreaInfo(conn, { library, dataArea }))[0];
+            }
+            catch {
+                info = undefined;
+            }
+            const command = buildChangeDataAreaCommand(library, dataArea, value, info, args);
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({ ok: cmdResult.code === 0, command, ...cmdResult });
+            return commandOutcome({ ok: cmdResult.code === 0, command, dataAreaType: info?.type || null, ...cmdResult });
         }
         case "ibmi.audit.list": {
             const data = await listAuditRecords({
@@ -2163,7 +2575,7 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.audit.export": {
             const exported = await exportAuditRecords({
-                outputPath: String(args.outputPath),
+                outputPath: await guardLocalPath(ctx, args.outputPath, "write"),
                 format: args?.format,
                 filter: {
                     limit: args?.limit,
@@ -2177,8 +2589,8 @@ export async function handleTool(ctx, name, args) {
             return json(exported);
         }
         case "ibmi.audit.purge": {
-            if (!Boolean(args?.dryRun) && !Boolean(args?.approve)) {
-                throw new Error("ibmi.audit.purge requires approve=true unless dryRun=true.");
+            if (!Boolean(args?.dryRun)) {
+                await requireDangerousApproval(ctx, "audit.purge", args, "ibmi.audit.purge requires approve=true unless dryRun=true.");
             }
             const purged = await purgeAuditRecords({
                 before: String(args.before),
@@ -2197,6 +2609,7 @@ export async function handleTool(ctx, name, args) {
             const journal = requireIbmObjectName(args.journal, "journal");
             const objectLibrary = args?.objectLibrary ? requireIbmObjectName(args.objectLibrary, "objectLibrary") : undefined;
             const objectName = args?.objectName ? requireIbmObjectName(args.objectName, "objectName") : undefined;
+            const objectType = args?.objectType ? requireObjectTypeValue(args.objectType, "objectType") : undefined;
             const journalCode = args?.journalCode ? requireJournalCode(args.journalCode) : undefined;
             const entryType = args?.entryType ? requireJournalEntryType(args.entryType) : undefined;
             const userName = args?.userName ? requireIbmObjectName(args.userName, "userName") : undefined;
@@ -2210,6 +2623,7 @@ export async function handleTool(ctx, name, args) {
                 journal,
                 objectLibrary,
                 objectName,
+                objectType,
                 journalCode,
                 entryType,
                 userName,
@@ -2250,13 +2664,13 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.journal.receiver.create": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const lib = requireIbmObjectName(args.library, "library");
             const rcv = requireIbmObjectName(args.receiver, "receiver");
             const threshold = clampNumber(args?.threshold, 1000000, 1, 1000000000);
             const command = `CRTJRNRCV JRNRCV(${lib}/${rcv}) THRESHOLD(${threshold})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({
+            return commandOutcome({
                 ok: cmdResult.code === 0,
                 command,
                 ...cmdResult
@@ -2264,14 +2678,14 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.journal.create": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const lib = requireIbmObjectName(args.library, "library");
             const jrn = requireIbmObjectName(args.journal, "journal");
             const rcvLib = requireIbmObjectName(args.receiverLibrary, "receiverLibrary");
             const rcv = requireIbmObjectName(args.receiver, "receiver");
             const command = `CRTJRN JRN(${lib}/${jrn}) JRNRCV(${rcvLib}/${rcv})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({
+            return commandOutcome({
                 ok: cmdResult.code === 0,
                 command,
                 ...cmdResult
@@ -2279,14 +2693,14 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.journal.receiver.change": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const jrnLib = requireIbmObjectName(args.journalLibrary, "journalLibrary");
             const jrn = requireIbmObjectName(args.journal, "journal");
             const rcvLib = requireIbmObjectName(args.receiverLibrary, "receiverLibrary");
             const rcv = requireIbmObjectName(args.receiver, "receiver");
             const command = `CHGJRN JRN(${jrnLib}/${jrn}) JRNRCV(${rcvLib}/${rcv})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({
+            return commandOutcome({
                 ok: cmdResult.code === 0,
                 command,
                 ...cmdResult
@@ -2294,7 +2708,7 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.journal.startPf": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const lib = requireIbmObjectName(args.library, "library");
             const file = requireIbmObjectName(args.file, "file");
             const jrnLib = requireIbmObjectName(args.journalLibrary, "journalLibrary");
@@ -2305,7 +2719,7 @@ export async function handleTool(ctx, name, args) {
             }
             const command = `STRJRNPF FILE(${lib}/${file}) JRN(${jrnLib}/${jrn}) IMAGES(${images})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({
+            return commandOutcome({
                 ok: cmdResult.code === 0,
                 command,
                 ...cmdResult
@@ -2313,12 +2727,12 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.journal.endPf": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const lib = requireIbmObjectName(args.library, "library");
             const file = requireIbmObjectName(args.file, "file");
             const command = `ENDJRNPF FILE(${lib}/${file})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({
+            return commandOutcome({
                 ok: cmdResult.code === 0,
                 command,
                 ...cmdResult
@@ -2326,14 +2740,14 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.journal.startIfs": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const objectType = requireIfsJournalObjectType(args?.objectType);
             const journalLibrary = requireIbmObjectName(args.journalLibrary, "journalLibrary");
             const journal = requireIbmObjectName(args.journal, "journal");
             const objectPath = requireIfsPath(args.path, "path");
             const command = `STRJRNOBJ OBJ((${quoteClString(objectPath)} ${objectType})) JRN(${journalLibrary}/${journal})`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({
+            return commandOutcome({
                 ok: cmdResult.code === 0,
                 command,
                 ...cmdResult
@@ -2341,12 +2755,12 @@ export async function handleTool(ctx, name, args) {
         }
         case "ibmi.journal.endIfs": {
             const conn = await ctx.ensureActive(args?.connectionName);
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const objectType = requireIfsJournalObjectType(args?.objectType);
             const objectPath = requireIfsPath(args.path, "path");
             const command = `ENDJRNOBJ OBJ((${quoteClString(objectPath)} ${objectType}))`;
             const cmdResult = await runClCommand(conn, command, "ile", undefined, 45000);
-            return json({
+            return commandOutcome({
                 ok: cmdResult.code === 0,
                 command,
                 ...cmdResult
@@ -2358,9 +2772,11 @@ export async function handleTool(ctx, name, args) {
             const journal = requireIbmObjectName(args.journal, "journal");
             const retentionDays = clampNumber(args?.retentionDays, 30, 1, 36500);
             const maxDeletes = clampNumber(args?.maxDeletes, 50, 1, 500);
-            const dryRun = Boolean(args?.dryRun);
-            if (!dryRun && !Boolean(args?.approve)) {
-                throw new Error("ibmi.journal.receivers.retention requires approve=true unless dryRun=true.");
+            // The schema documents dryRun as defaulting to true; only an explicit
+            // dryRun=false may delete receivers.
+            const dryRun = args?.dryRun === undefined || args?.dryRun === null ? true : Boolean(args.dryRun);
+            if (!dryRun) {
+                await requireDangerousApproval(ctx, "journal.receivers.delete", args, "ibmi.journal.receivers.retention requires approve=true unless dryRun=true.");
             }
             const plan = await planJournalReceiverRetention(conn, {
                 journalLibrary,
@@ -2378,7 +2794,7 @@ export async function handleTool(ctx, name, args) {
                     candidates
                 });
             }
-            enforceWritable(ctx, conn, "qsys.write", args);
+            await enforceWritable(ctx, conn, "qsys.write", args);
             const deleted = [];
             for (const candidate of candidates) {
                 const command = `DLTJRNRCV JRNRCV(${candidate.receiverLibrary}/${candidate.receiver}) DLTOPT(*IGNINQMSG)`;
@@ -2390,7 +2806,7 @@ export async function handleTool(ctx, name, args) {
                     error: result.code === 0 ? undefined : String(result.stderr || "")
                 });
             }
-            return json({
+            return commandOutcome({
                 ok: deleted.every(item => item.ok),
                 dryRun: false,
                 retentionDays,
@@ -2416,7 +2832,7 @@ export async function handleTool(ctx, name, args) {
             if (!args?.outputPath) {
                 return json(report);
             }
-            const outputPath = path.resolve(String(args.outputPath));
+            const outputPath = await guardLocalPath(ctx, args.outputPath, "write");
             await fs.mkdir(path.dirname(outputPath), { recursive: true });
             await fs.writeFile(outputPath, JSON.stringify(report, null, 2), "utf8");
             let signaturePath;
@@ -2444,116 +2860,6 @@ export async function handleTool(ctx, name, args) {
                 signature
             });
         }
-        case "ibmi.tn5250.connect": {
-            const name = getConnectionName(ctx, args);
-            await ctx.ensureActive(name);
-            const session = ensureTn5250Session(name);
-            appendTn5250Message(session, `Session ready for ${name}.`);
-            return json(session.screen);
-        }
-        case "ibmi.tn5250.readScreen": {
-            const session = requireTn5250Session(ctx, args);
-            return json(session.screen);
-        }
-        case "ibmi.tn5250.setField": {
-            const session = requireTn5250Session(ctx, args);
-            const field = findTn5250Field(session, args.fieldId);
-            if (!field)
-                throw new Error(`TN5250 field not found: ${args.fieldId}`);
-            if (field.protected)
-                throw new Error(`TN5250 field is protected: ${field.id}`);
-            const value = String(args.value || "");
-            field.value = value.length > field.length ? value.substring(0, field.length) : value;
-            touchTn5250Session(session);
-            return json(session.screen);
-        }
-        case "ibmi.tn5250.sendKeys": {
-            const session = requireTn5250Session(ctx, args);
-            const conn = await ctx.ensureActive(session.connectionName);
-            const keys = parseTn5250Keys(args.keys);
-            const timeoutMs = clampNumber(args?.timeoutMs, 45000, 1000, 300000);
-            const commandField = findTn5250Field(session, "command");
-            session.screen.lastKeys = keys;
-            session.screen.status = "busy";
-            touchTn5250Session(session);
-            for (const key of keys) {
-                if (key === "ENTER" || key === "RETURN") {
-                    const command = String(commandField?.value || "").trim();
-                    if (!command) {
-                        appendTn5250Message(session, "No command entered.");
-                        continue;
-                    }
-                    enforcePolicyOperation(ctx, "cl.run", {
-                        ...args,
-                        command,
-                        connectionName: session.connectionName
-                    });
-                    const cmdResult = await runClCommand(conn, command, "ile", undefined, timeoutMs);
-                    const recent = await readRecentJoblogMessages(conn, 5);
-                    const messages = recent.map((row) => {
-                        const id = String(row.MESSAGE_ID || "");
-                        const text = String(row.MESSAGE_TEXT || "");
-                        return id ? `[${id}] ${text}` : text;
-                    });
-                    session.screen.commandHistory.unshift({
-                        at: new Date().toISOString(),
-                        command,
-                        ok: cmdResult.code === 0,
-                        code: cmdResult.code,
-                        stderr: cmdResult.stderr ? String(cmdResult.stderr) : undefined,
-                        messages: messages.slice(0, 5)
-                    });
-                    if (session.screen.commandHistory.length > TN5250_MAX_HISTORY) {
-                        session.screen.commandHistory = session.screen.commandHistory.slice(0, TN5250_MAX_HISTORY);
-                    }
-                    appendTn5250Message(session, `${cmdResult.code === 0 ? "OK" : "ERROR"}: ${command}`);
-                    for (const line of messages.slice(0, 3)) {
-                        appendTn5250Message(session, line);
-                    }
-                    if (commandField)
-                        commandField.value = "";
-                    continue;
-                }
-                if (key === "CLEAR" || key === "F3" || key === "F12") {
-                    resetTn5250Screen(session, `Cleared via ${key}.`);
-                    continue;
-                }
-                if (key === "TAB") {
-                    rotateTn5250Cursor(session);
-                    continue;
-                }
-                appendTn5250Message(session, `Unsupported key: ${key}`);
-            }
-            session.screen.status = "ready";
-            touchTn5250Session(session);
-            return json(session.screen);
-        }
-        case "ibmi.tn5250.waitFor": {
-            const session = requireTn5250Session(ctx, args);
-            const timeoutMs = clampNumber(args?.timeoutMs, 5000, 250, 120000);
-            const pattern = args?.text ? String(args.text) : "";
-            if (!pattern) {
-                return json({ matched: true, timeoutMs, screen: session.screen });
-            }
-            const matched = await waitForTn5250Text(session, pattern, timeoutMs);
-            return json({ matched, text: pattern, timeoutMs, screen: session.screen });
-        }
-        case "ibmi.tn5250.snapshot": {
-            const session = requireTn5250Session(ctx, args);
-            return json({
-                capturedAt: new Date().toISOString(),
-                connectionName: session.connectionName,
-                plainText: renderTn5250Screen(session.screen),
-                screen: session.screen
-            });
-        }
-        case "ibmi.tn5250.disconnect": {
-            const name = resolveTn5250SessionName(ctx, args);
-            if (!name)
-                throw new Error("connectionName is required (no active session)");
-            const existed = tn5250Sessions.delete(name);
-            return json({ disconnected: existed, connectionName: name });
-        }
     }
     throw new Error(`Unknown tool: ${name}`);
 }
@@ -2562,7 +2868,7 @@ async function listActions(ctx) {
     const custom = await ctx.store.listActions();
     return [...builtins, ...custom];
 }
-async function resolveAction(ctx, args) {
+export async function resolveAction(ctx, args) {
     if (args.action)
         return args.action;
     if (!args.actionName)
@@ -2570,7 +2876,7 @@ async function resolveAction(ctx, args) {
     const actions = await listActions(ctx);
     return actions.find(a => a.name === args.actionName);
 }
-async function runClCommand(conn, command, environment, cwd, timeoutMs) {
+export async function runClCommand(conn, command, environment, cwd, timeoutMs) {
     if (environment === "pase") {
         return await withTimeout(conn.sendCommand({ command, directory: cwd }), timeoutMs, `CL command timed out after ${timeoutMs}ms`);
     }
@@ -2578,22 +2884,16 @@ async function runClCommand(conn, command, environment, cwd, timeoutMs) {
         return await withTimeout(conn.sendQsh({ command, directory: cwd }), timeoutMs, `CL command timed out after ${timeoutMs}ms`);
     }
     try {
-        await withTimeout(conn.runSQL(`CALL QSYS2.QCMDEXC(${Tools.sqlString(command)})`), timeoutMs, `CL command timed out after ${timeoutMs}ms`);
+        await runSqlWithTimeout(conn, `CALL QSYS2.QCMDEXC(${Tools.sqlString(command)})`, timeoutMs, `CL command timed out after ${timeoutMs}ms`);
         return { code: 0, signal: null, stdout: "", stderr: "", command };
     }
     catch (err) {
         return { code: 1, signal: null, stdout: "", stderr: err?.message || String(err), command };
     }
 }
-async function readRecentJoblogMessages(conn, limit) {
-    try {
-        const capped = clampNumber(limit, 5, 1, 20);
-        return await conn.runSQL(`select message_id, message_text, severity, message_timestamp from table(qsys2.joblog_info('*')) order by message_timestamp desc fetch first ${capped} rows only`);
-    }
-    catch {
-        return [];
-    }
-}
+// Every filter is applied on the IBM i (table function parameters and WHERE
+// predicates) before FETCH FIRST, so the row cap never hides matching entries.
+// Rows come back newest first.
 async function queryJournalEntries(conn, options) {
     let rows;
     try {
@@ -2602,42 +2902,7 @@ async function queryJournalEntries(conn, options) {
     catch {
         rows = await queryJournalEntriesViaOutfile(conn, options);
     }
-    let normalized = rows.map(normalizeJournalEntry);
-    if (options.objectLibrary) {
-        normalized = normalized.filter(row => (row.objectLibrary || "") === options.objectLibrary);
-    }
-    if (options.objectName) {
-        normalized = normalized.filter(row => (row.objectName || "") === options.objectName);
-    }
-    if (options.journalCode) {
-        normalized = normalized.filter(row => (row.journalCode || "") === options.journalCode);
-    }
-    if (options.entryType) {
-        normalized = normalized.filter(row => (row.entryType || "") === options.entryType);
-    }
-    if (options.userName) {
-        normalized = normalized.filter(row => (row.userName || "") === options.userName);
-    }
-    if (options.jobName) {
-        normalized = normalized.filter(row => (row.jobName || "").includes(options.jobName));
-    }
-    if (options.programName) {
-        normalized = normalized.filter(row => (row.programName || "") === options.programName);
-    }
-    if (typeof options.sinceSequence === "number") {
-        normalized = normalized.filter(row => typeof row.sequence === "number" && row.sequence >= options.sinceSequence);
-    }
-    if (options.sinceTimestamp) {
-        const cutoff = Date.parse(options.sinceTimestamp);
-        if (Number.isFinite(cutoff)) {
-            normalized = normalized.filter(row => {
-                if (!row.timestamp)
-                    return false;
-                const value = Date.parse(row.timestamp);
-                return Number.isFinite(value) && value >= cutoff;
-            });
-        }
-    }
+    const normalized = rows.map(normalizeJournalEntry);
     normalized.sort((a, b) => {
         const aSeq = typeof a.sequence === "number" ? a.sequence : -1;
         const bSeq = typeof b.sequence === "number" ? b.sequence : -1;
@@ -2649,6 +2914,27 @@ async function queryJournalEntries(conn, options) {
     });
     return normalized.slice(0, options.limit);
 }
+// Turns an ISO-8601 or IBM i style timestamp into a Db2 for i timestamp
+// expression in the system's local time. Values with an explicit zone (Z or
+// +hh:mm) are converted from UTC with CURRENT TIMEZONE; values without a zone
+// are taken as system local time.
+function sqlTimestampExpression(value) {
+    const raw = String(value || "").trim();
+    const local = raw.match(/^(\d{4})-(\d{2})-(\d{2})(?:[ T-](\d{2})[:.](\d{2})(?:[:.](\d{2})(?:\.(\d{1,6}))?)?)?$/);
+    if (local) {
+        const [, y, mo, d, h = "00", mi = "00", s = "00", frac = "0"] = local;
+        return `timestamp('${y}-${mo}-${d}-${h}.${mi}.${s}.${frac.padEnd(6, "0")}')`;
+    }
+    if (!/(?:Z|[+-]\d{2}:?\d{2})$/i.test(raw)) {
+        throw new Error(`Invalid sinceTimestamp: ${value}`);
+    }
+    const parsed = Date.parse(raw);
+    if (!Number.isFinite(parsed))
+        throw new Error(`Invalid sinceTimestamp: ${value}`);
+    const iso = new Date(parsed).toISOString();
+    const db2 = `${iso.slice(0, 10)}-${iso.slice(11, 13)}.${iso.slice(14, 16)}.${iso.slice(17, 19)}.${iso.slice(20, 23)}000`;
+    return `(timestamp('${db2}') + current timezone)`;
+}
 async function queryJobs(conn, options) {
     const scanLimit = Math.min(options.limit * 5, 5000);
     const rows = [];
@@ -2728,27 +3014,61 @@ function normalizeActiveJobRow(row) {
         cpuSeconds: toNullableNumber(pickFirst(row, ["CPU_TIME", "TOTAL_CPU_TIME", "ELAPSED_TOTAL_SECONDS"]))
     };
 }
+// Newest messages first. The table function form takes QUEUE_LIBRARY and
+// QUEUE_NAME; the view form is the fallback for releases without it.
 async function queryMessageQueueEntries(conn, options) {
     let rows;
     try {
-        rows = await conn.runSQL(`select * from table(qsys2.message_queue_info(message_queue_name => ${Tools.sqlString(options.messageQueue)}, message_queue_library => ${Tools.sqlString(options.library)})) fetch first ${options.limit} rows only`);
+        rows = await conn.runSQL(`select x.*, hex(x.message_key) as message_key_hex from table(qsys2.message_queue_info(queue_library => ${Tools.sqlString(options.library)}, queue_name => ${Tools.sqlString(options.messageQueue)})) x ` +
+            `order by message_timestamp desc fetch first ${options.limit} rows only`);
     }
     catch {
-        rows = await conn.runSQL(`select * from qsys2.message_queue_info where upper(message_queue_name)=${Tools.sqlString(options.messageQueue)} and upper(message_queue_library)=${Tools.sqlString(options.library)} fetch first ${options.limit} rows only`);
+        rows = await conn.runSQL(`select x.*, hex(x.message_key) as message_key_hex from qsys2.message_queue_info x where message_queue_name=${Tools.sqlString(options.messageQueue)} and message_queue_library=${Tools.sqlString(options.library)} ` +
+            `order by message_timestamp desc fetch first ${options.limit} rows only`);
     }
     return rows.map(normalizeMessageQueueEntry);
 }
-async function querySpoolEntries(conn, limit) {
-    const queries = [
-        `select * from qsys2.output_queue_entries fetch first ${limit} rows only`,
-        `select * from table(qsys2.output_queue_entries()) fetch first ${limit} rows only`,
-        `select job_name, spooled_file_name, spooled_file_number, output_queue_name, total_pages, file_status from qsys2.output_queue_entries fetch first ${limit} rows only`,
-        `select job_name, spooled_file_name, spooled_file_number, output_queue_name, total_pages, cast('' as varchar(10)) as file_status from qsys2.output_queue_entries fetch first ${limit} rows only`,
-        `select job_name, spooled_file_name, cast(0 as integer) as spooled_file_number, output_queue_name, total_pages, file_status from qsys2.output_queue_entries fetch first ${limit} rows only`,
-        `select job_name, spooled_file_name, cast(0 as integer) as spooled_file_number, output_queue_name, total_pages, cast('' as varchar(10)) as file_status from qsys2.output_queue_entries fetch first ${limit} rows only`,
-        `select * from qsys2.spooled_file_info fetch first ${limit} rows only`,
-        `select * from table(qsys2.spooled_file_info()) fetch first ${limit} rows only`
-    ];
+// QSYS2.OUTPUT_QUEUE_ENTRIES columns: USER_NAME, OUTPUT_QUEUE_NAME,
+// OUTPUT_QUEUE_LIBRARY_NAME, JOB_NAME (qualified), CREATE_TIMESTAMP, ...
+function buildSpoolWhereClause(options) {
+    const predicates = [];
+    if (options.userName)
+        predicates.push(`user_name = ${Tools.sqlString(options.userName)}`);
+    if (options.outputQueue)
+        predicates.push(`output_queue_name = ${Tools.sqlString(options.outputQueue)}`);
+    if (options.outputQueueLibrary)
+        predicates.push(`output_queue_library_name = ${Tools.sqlString(options.outputQueueLibrary)}`);
+    if (options.jobName) {
+        predicates.push(options.jobName.includes("/")
+            ? `job_name = ${Tools.sqlString(options.jobName)}`
+            : `job_name like ${Tools.sqlString(`%/${options.jobName}`)}`);
+    }
+    return predicates.length > 0 ? ` where ${predicates.join(" and ")}` : "";
+}
+async function querySpoolEntries(conn, options) {
+    const limit = options.limit;
+    const where = buildSpoolWhereClause(options);
+    const queries = [];
+    // OUTPUT_QUEUE_ENTRIES scans every spooled file on the system before the
+    // WHERE applies, which can take minutes. SPOOLED_FILE_INFO filters by user
+    // or job inside the service, so use it first when one of those is given.
+    const qualifiedJob = options.jobName?.includes("/") ? options.jobName : undefined;
+    if (options.userName || qualifiedJob) {
+        const params = [
+            options.userName ? `user_name => ${Tools.sqlString(options.userName)}` : "",
+            qualifiedJob ? `job_name => ${Tools.sqlString(qualifiedJob)}` : ""
+        ].filter(Boolean).join(", ");
+        const filters = [
+            options.outputQueue ? `output_queue = ${Tools.sqlString(options.outputQueue)}` : "",
+            options.outputQueueLibrary ? `output_queue_library = ${Tools.sqlString(options.outputQueueLibrary)}` : "",
+            options.jobName && !qualifiedJob ? `job_name = ${Tools.sqlString(options.jobName)}` : ""
+        ].filter(Boolean);
+        queries.push(`select * from table(qsys2.spooled_file_info(${params})) x${filters.length ? ` where ${filters.join(" and ")}` : ""} order by creation_timestamp desc fetch first ${limit} rows only`);
+    }
+    queries.push(`select * from qsys2.output_queue_entries${where} order by create_timestamp desc fetch first ${limit} rows only`, `select * from qsys2.output_queue_entries${where} fetch first ${limit} rows only`);
+    if (!where) {
+        queries.push(`select * from table(qsys2.output_queue_entries()) fetch first ${limit} rows only`, `select * from qsys2.spooled_file_info fetch first ${limit} rows only`, `select * from table(qsys2.spooled_file_info()) fetch first ${limit} rows only`);
+    }
     let lastError;
     for (const sql of queries) {
         try {
@@ -2763,7 +3083,8 @@ async function querySpoolEntries(conn, limit) {
 function normalizeMessageQueueEntry(row) {
     return {
         source: "msgq",
-        messageKey: toNullableString(pickFirst(row, ["MESSAGE_KEY", "MSGKEY"])),
+        // The raw key is binary; the hex form is what ibmi.msgq.reply accepts.
+        messageKey: toNullableString(pickFirst(row, ["MESSAGE_KEY_HEX", "MSGKEY"])),
         messageId: toNullableString(pickFirst(row, ["MESSAGE_ID", "MSGID"])),
         messageType: toNullableString(pickFirst(row, ["MESSAGE_TYPE", "MSGTYPE"])),
         severity: toNullableNumber(pickFirst(row, ["SEVERITY", "MSGSEV"])),
@@ -2772,23 +3093,35 @@ function normalizeMessageQueueEntry(row) {
         sentAt: toNullableString(pickFirst(row, ["MESSAGE_TIMESTAMP", "SENT_TIMESTAMP"]))
     };
 }
+// QSYS2.OBJECT_LOCK_INFO is a view; filters go into its WHERE clause so the row
+// cap applies to matching locks only.
 async function queryLockEntries(conn, options) {
+    const base = [];
+    if (options.objectLibrary)
+        base.push(`object_schema = ${Tools.sqlString(options.objectLibrary)}`);
+    if (options.objectName)
+        base.push(`object_name = ${Tools.sqlString(options.objectName)}`);
+    if (options.objectType)
+        base.push(`object_type = ${Tools.sqlString(options.objectType)}`);
+    const memberPredicate = options.member ? `system_table_member = ${Tools.sqlString(options.member)}` : undefined;
+    const whereOf = (predicates) => predicates.length > 0 ? ` where ${predicates.join(" and ")}` : "";
     let rows;
+    let filterMemberLocally = false;
     try {
-        rows = await conn.runSQL(`select * from table(qsys2.object_lock_info()) fetch first ${Math.min(options.limit, 500)} rows only`);
+        rows = await conn.runSQL(`select * from qsys2.object_lock_info${whereOf(memberPredicate ? [...base, memberPredicate] : base)} fetch first ${options.limit} rows only`);
     }
-    catch {
-        rows = await conn.runSQL(`select * from qsys2.object_lock_info fetch first ${Math.min(options.limit, 500)} rows only`);
+    catch (err) {
+        if (!memberPredicate)
+            throw err;
+        // Fallback when the member column is named differently on this release:
+        // keep the object filters in SQL and match the member locally.
+        rows = await conn.runSQL(`select * from qsys2.object_lock_info${whereOf(base)} fetch first 5000 rows only`);
+        filterMemberLocally = true;
     }
     let normalized = rows.map(normalizeLockEntry);
-    if (options.objectLibrary)
-        normalized = normalized.filter(row => (row.objectLibrary || "") === String(options.objectLibrary).toUpperCase());
-    if (options.objectName)
-        normalized = normalized.filter(row => (row.objectName || "") === String(options.objectName).toUpperCase());
-    if (options.objectType)
-        normalized = normalized.filter(row => (row.objectType || "") === String(options.objectType).toUpperCase());
-    if (options.member)
-        normalized = normalized.filter(row => (row.member || "") === String(options.member).toUpperCase());
+    if (filterMemberLocally && options.member) {
+        normalized = normalized.filter(row => (row.member || "") === options.member);
+    }
     return normalized.slice(0, options.limit);
 }
 function normalizeLockEntry(row) {
@@ -2797,7 +3130,7 @@ function normalizeLockEntry(row) {
         objectLibrary: toNullableString(pickFirst(row, ["OBJECT_SCHEMA", "OBJECT_LIBRARY", "OBJLIB"])),
         objectName: toNullableString(pickFirst(row, ["OBJECT_NAME", "OBJNAME"])),
         objectType: toNullableString(pickFirst(row, ["OBJECT_TYPE", "OBJTYPE"])),
-        member: toNullableString(pickFirst(row, ["MEMBER_NAME", "MEMBER"])),
+        member: toNullableString(pickFirst(row, ["SYSTEM_TABLE_MEMBER", "MEMBER_NAME", "MEMBER"])),
         lockState: toNullableString(pickFirst(row, ["LOCK_STATE", "LOCK_STATUS", "STATUS"])),
         lockScope: toNullableString(pickFirst(row, ["LOCK_SCOPE", "SCOPE"])),
         lockHolderJob: toNullableString(pickFirst(row, ["JOB_NAME", "LOCK_JOB_NAME"])),
@@ -2825,23 +3158,27 @@ function normalizeObjectAuthorityRow(row) {
         raw: row
     };
 }
+const DATA_QUEUE_MAX_WAIT_SECONDS = 60;
+// remove=false never falls back to anything that takes the entry off the
+// queue: it peeks with RECEIVE_DATA_QUEUE(REMOVE => 'NO') and then with the
+// read-only DATA_QUEUE_ENTRIES service.
 async function queryDataQueueEntries(conn, options) {
+    const queue = Tools.sqlString(options.queue);
+    const library = Tools.sqlString(options.library);
+    const waitSeconds = Math.max(0, Math.min(DATA_QUEUE_MAX_WAIT_SECONDS, Math.floor(options.waitSeconds)));
     let rows;
+    if (options.remove) {
+        rows = await conn.runSQL(`select * from table(qsys2.receive_data_queue(data_queue => ${queue}, data_queue_library => ${library}, ` +
+            `wait_time => ${waitSeconds}, remove => 'YES')) fetch first 1 rows only`);
+        return rows.map(normalizeDataQueueEntry);
+    }
     try {
-        rows = await conn.runSQL(`select * from table(qsys2.receive_data_queue(${Tools.sqlString(options.queue)}, ${Tools.sqlString(options.library)}, ${Tools.sqlString(options.remove ? "YES" : "NO")}, ${options.waitSeconds})) fetch first 1 rows only`);
+        rows = await conn.runSQL(`select * from table(qsys2.receive_data_queue(data_queue => ${queue}, data_queue_library => ${library}, ` +
+            `wait_time => ${waitSeconds}, remove => 'NO')) fetch first 1 rows only`);
     }
     catch {
-        try {
-            rows = await conn.runSQL(`select * from table(qsys2.receive_data_queue(${Tools.sqlString(options.queue)}, ${Tools.sqlString(options.library)})) fetch first 1 rows only`);
-        }
-        catch {
-            try {
-                rows = await conn.runSQL(`select * from table(qsys2.data_queue_entries(${Tools.sqlString(options.queue)}, ${Tools.sqlString(options.library)})) fetch first 1 rows only`);
-            }
-            catch {
-                rows = await conn.runSQL(`select * from qsys2.data_queue_entries where upper(data_queue_name)=${Tools.sqlString(options.queue)} and upper(data_queue_library)=${Tools.sqlString(options.library)} fetch first 1 rows only`);
-            }
-        }
+        rows = await conn.runSQL(`select * from table(qsys2.data_queue_entries(data_queue => ${queue}, data_queue_library => ${library})) ` +
+            `order by ordinal_position fetch first 1 rows only`);
     }
     return rows.map(normalizeDataQueueEntry);
 }
@@ -2871,7 +3208,8 @@ function normalizeDataAreaInfoRow(row) {
         dataArea: toNullableString(pickFirst(row, ["DATA_AREA_NAME", "OBJECT_NAME"])),
         type: toNullableString(pickFirst(row, ["DATA_AREA_TYPE", "OBJECT_TYPE"])),
         length: toNullableNumber(pickFirst(row, ["LENGTH", "DATA_AREA_LENGTH"])),
-        value: toNullableString(pickFirst(row, ["CHARACTER_VALUE", "VALUE", "DECIMAL_VALUE"])),
+        decimalPositions: toNullableNumber(pickFirst(row, ["DECIMAL_POSITIONS"])),
+        value: toNullableString(pickFirst(row, ["DATA_AREA_VALUE", "CHARACTER_VALUE", "VALUE", "DECIMAL_VALUE"])),
         updatedAt: toNullableString(pickFirst(row, ["LAST_CHANGED_TIMESTAMP", "CHANGE_TIMESTAMP"]))
     };
 }
@@ -2884,22 +3222,100 @@ function buildSpoolCommand(commandName, args) {
         : "*LAST";
     return `${commandName} FILE(${spooledFileName}) JOB(${jobName}) SPLNBR(${spooledFileNumber})`;
 }
+function isQualifiedJobName(value) {
+    return /^[^/]+\/[^/]+\/[^/]+$/.test(value);
+}
 async function queryJournalEntriesViaDisplayJournal(conn, options) {
-    const sampleSize = Math.min(options.limit * 5, 5000);
-    const rows = await conn.runSQL(`select * from table(qsys2.display_journal(journal_name => ${Tools.sqlString(options.journal)}, journal_library => ${Tools.sqlString(options.journalLibrary)})) fetch first ${sampleSize} rows only`);
+    if (options.objectLibrary && !options.objectName) {
+        // A library on its own is not a DISPLAY_JOURNAL filter; the outfile path
+        // filters it in SQL.
+        throw new Error("objectLibrary without objectName is handled by the DSPJRN outfile query");
+    }
+    const params = [
+        `journal_library => ${Tools.sqlString(options.journalLibrary)}`,
+        `journal_name => ${Tools.sqlString(options.journal)}`
+    ];
+    const where = [];
+    const since = options.sinceTimestamp ? sqlTimestampExpression(options.sinceTimestamp) : undefined;
+    if (typeof options.sinceSequence === "number" || since) {
+        // Search the whole receiver chain, not only the attached receiver, when a
+        // starting point is given.
+        params.push(`starting_receiver_name => '*CURCHAIN'`);
+    }
+    if (typeof options.sinceSequence === "number") {
+        params.push(`starting_sequence => ${Math.max(0, Math.floor(options.sinceSequence))}`);
+        where.push(`sequence_number >= ${Math.max(0, Math.floor(options.sinceSequence))}`);
+        if (since)
+            where.push(`entry_timestamp >= ${since}`);
+    }
+    else if (since) {
+        params.push(`starting_timestamp => ${since}`);
+    }
+    if (options.journalCode)
+        params.push(`journal_codes => ${Tools.sqlString(options.journalCode)}`);
+    if (options.entryType)
+        params.push(`journal_entry_types => ${Tools.sqlString(options.entryType)}`);
+    if (options.objectName) {
+        params.push(`object_library => ${Tools.sqlString(options.objectLibrary || "*LIBL")}`);
+        params.push(`object_name => ${Tools.sqlString(options.objectName)}`);
+        const objectType = options.objectType || "*FILE";
+        params.push(`object_objtype => ${Tools.sqlString(objectType)}`);
+        if (objectType === "*FILE")
+            params.push(`object_member => '*ALL'`);
+    }
+    if (options.userName)
+        params.push(`user => ${Tools.sqlString(options.userName)}`);
+    if (options.programName)
+        params.push(`program => ${Tools.sqlString(options.programName)}`);
+    if (options.jobName) {
+        if (isQualifiedJobName(options.jobName))
+            params.push(`job => ${Tools.sqlString(options.jobName)}`);
+        else
+            where.push(`job_name = ${Tools.sqlString(options.jobName)}`);
+    }
+    const whereClause = where.length > 0 ? ` where ${where.join(" and ")}` : "";
+    const rows = await conn.runSQL(`select * from table(qsys2.display_journal(${params.join(", ")}))${whereClause} ` +
+        `order by sequence_number desc fetch first ${options.limit} rows only`);
     return rows;
 }
+// DSPJRN writes to QTEMP, which belongs to one job. The CALL QCMDEXC and the
+// SELECT are sent in the same QZDFMDB2 request so they run in the same job.
 async function queryJournalEntriesViaOutfile(conn, options) {
-    const outfile = `MCPJ${String(Math.floor(Math.random() * 90000) + 10000)}`;
-    const fileFilter = options.objectLibrary && options.objectName
-        ? ` FILE((${options.objectLibrary}/${options.objectName}))`
-        : "";
-    const command = `DSPJRN JRN(${options.journalLibrary}/${options.journal}) OUTPUT(*OUTFILE) OUTFILE(QTEMP/${outfile})${fileFilter}`;
-    const result = await runClCommand(conn, command, "ile", undefined, 45000);
-    if (result.code !== 0) {
-        throw new Error(result.stderr || "Unable to query journal entries");
-    }
-    const rows = await conn.runSQL(`select * from QTEMP.${outfile}`);
+    const outfile = `MCPJ${String(Math.floor(Math.random() * 900000) + 100000)}`;
+    const rangeOption = typeof options.sinceSequence === "number" || options.sinceTimestamp ? " RCVRNG(*CURCHAIN)" : "";
+    const command = `DSPJRN JRN(${options.journalLibrary}/${options.journal})${rangeOption} ` +
+        `OUTPUT(*OUTFILE) OUTFILFMT(*TYPE5) OUTFILE(QTEMP/${outfile})`;
+    const where = [];
+    if (options.objectLibrary)
+        where.push(`JOLIB = ${Tools.sqlString(options.objectLibrary)}`);
+    if (options.objectName)
+        where.push(`JOOBJ = ${Tools.sqlString(options.objectName)}`);
+    if (options.journalCode)
+        where.push(`JOCODE = ${Tools.sqlString(options.journalCode)}`);
+    if (options.entryType)
+        where.push(`JOENTT = ${Tools.sqlString(options.entryType)}`);
+    if (options.userName)
+        where.push(`JOUSPF = ${Tools.sqlString(options.userName)}`);
+    if (options.programName)
+        where.push(`JOPGM = ${Tools.sqlString(options.programName)}`);
+    if (options.jobName) {
+        if (isQualifiedJobName(options.jobName)) {
+            const [number, user, name] = options.jobName.split("/");
+            where.push(`JONBR = ${Tools.sqlString(number)}`, `JOUSER = ${Tools.sqlString(user)}`, `JOJOB = ${Tools.sqlString(name)}`);
+        }
+        else {
+            where.push(`JOJOB = ${Tools.sqlString(options.jobName)}`);
+        }
+    }
+    if (typeof options.sinceSequence === "number")
+        where.push(`JOSEQN >= ${Math.max(0, Math.floor(options.sinceSequence))}`);
+    if (options.sinceTimestamp)
+        where.push(`JOTSTP >= ${sqlTimestampExpression(options.sinceTimestamp)}`);
+    const whereClause = where.length > 0 ? ` where ${where.join(" and ")}` : "";
+    const rows = await conn.runSQL([
+        `CALL QSYS2.QCMDEXC(${Tools.sqlString(command)});`,
+        `select * from QTEMP.${outfile}${whereClause} order by JOSEQN desc fetch first ${options.limit} rows only;`
+    ].join("\n"));
     return rows;
 }
 function normalizeJournalEntry(row) {
@@ -2911,7 +3327,7 @@ function normalizeJournalEntry(row) {
     const objectName = toNullableString(pickFirst(row, ["OBJECT_NAME", "JOOBJ", "OBJNAME"]));
     const objectType = toNullableString(pickFirst(row, ["OBJECT_TYPE", "JOOBJT", "OBJTYPE"]));
     const jobName = toNullableString(pickFirst(row, ["JOB_NAME", "JOJOB", "JOB"]));
-    const userName = toNullableString(pickFirst(row, ["USER_NAME", "JOUSER", "USER"]));
+    const userName = toNullableString(pickFirst(row, ["USER_NAME", "CURRENT_USER", "JOUSPF", "JOUSER", "USER"]));
     const programName = toNullableString(pickFirst(row, ["PROGRAM_NAME", "JOPGM", "PROGRAM"]));
     return {
         source: "journal",
@@ -2927,143 +3343,355 @@ function normalizeJournalEntry(row) {
         programName
     };
 }
-function pickFirst(row, keys) {
+export function pickFirst(row, keys) {
     for (const key of keys) {
         if (typeof row[key] !== "undefined" && row[key] !== null)
             return row[key];
     }
     return undefined;
 }
-function toNullableNumber(value) {
+export function toNullableNumber(value) {
     const n = Number(value);
     return Number.isFinite(n) ? n : null;
 }
-function toNullableString(value) {
+export function toNullableString(value) {
     if (typeof value === "undefined" || value === null)
         return null;
     const text = String(value).trim();
     return text.length > 0 ? text : null;
 }
-function ensureTn5250Session(connectionName) {
-    const existing = tn5250Sessions.get(connectionName);
-    if (existing) {
-        touchTn5250Session(existing);
-        return existing;
-    }
-    const now = new Date().toISOString();
-    const session = {
-        connectionName,
-        createdAt: Date.now(),
-        screen: {
-            sessionId: `tn5250:${connectionName}`,
-            connectionName,
-            title: "MCP TN5250 Command Session",
-            status: "ready",
-            textLines: [
-                `Connected to ${connectionName}.`,
-                "Set field 'command' (or fieldId '1') and send Enter.",
-                "Supported keys: Enter, Tab, F3, F12, Clear."
-            ],
-            fields: [
-                {
-                    id: "command",
-                    label: "Command",
-                    value: "",
-                    row: 20,
-                    col: 2,
-                    length: 512,
-                    protected: false
-                }
-            ],
-            cursorFieldId: "command",
-            lastKeys: [],
-            commandHistory: [],
-            updatedAt: now
+function hasMemberListExtensions(args) {
+    return args?.responseFormat === "page" || [
+        "member", "memberPrefix", "memberContains", "sourceTypes", "changedSince", "limit", "cursor"
+    ].some(key => typeof args?.[key] !== "undefined");
+}
+function hasStructuredMemberReadOptions(args) {
+    return args?.responseFormat === "structured" || [
+        "startLine", "endLine", "ranges", "before", "after", "metadataOnly",
+        "expectedVersion", "expectedSha256", "forceFresh"
+    ].some(key => typeof args?.[key] !== "undefined");
+}
+function memberVersionConflict(snapshot, args) {
+    const versionMismatch = args?.expectedVersion && args.expectedVersion !== snapshot.version;
+    const hashMismatch = args?.expectedSha256 && String(args.expectedSha256).toLowerCase() !== snapshot.sha256.toLowerCase();
+    if (!versionMismatch && !hashMismatch)
+        return undefined;
+    const { identity } = snapshot;
+    return toolError(`Version conflict: ${identity.library}/${identity.sourceFile}(${identity.member}) is now version ${snapshot.version}. ` +
+        "Nothing was modified. Re-read the member and retry with the current version.", {
+        code: "VERSION_CONFLICT",
+        status: "version-conflict",
+        identity,
+        expectedVersion: args?.expectedVersion,
+        expectedSha256: args?.expectedSha256,
+        actualVersion: snapshot.version,
+        actualSha256: snapshot.sha256,
+        currentVersion: snapshot.version,
+        currentSha256: snapshot.sha256,
+        observedAt: snapshot.observedAt,
+        modified: false
+    });
+}
+const DEFAULT_SOURCE_READ_MAX_BYTES = 2_000_000;
+const DEFAULT_SOURCE_READ_MAX_LINES = 50_000;
+const MAX_RANGE_LINES = 2_000;
+function sourceReadLimits(conn) {
+    const config = typeof conn?.getConfig === "function" ? conn.getConfig() || {} : {};
+    const read = (value, fallback) => {
+        const parsed = Number(value);
+        if (value === undefined || value === null || value === "" || !Number.isFinite(parsed) || parsed < 0)
+            return fallback;
+        return Math.floor(parsed);
+    };
+    return {
+        maxBytes: read(config.sourceReadMaxBytes, DEFAULT_SOURCE_READ_MAX_BYTES),
+        maxLines: read(config.sourceReadMaxLines, DEFAULT_SOURCE_READ_MAX_LINES)
+    };
+}
+function isFullMemberRead(args) {
+    return !args?.metadataOnly &&
+        typeof args?.startLine === "undefined" &&
+        typeof args?.endLine === "undefined" &&
+        !(Array.isArray(args?.ranges) && args.ranges.length > 0);
+}
+function exceedsSourceLimits(content, lineCount, limits) {
+    const bytes = Buffer.byteLength(content, "utf8");
+    const lines = typeof lineCount === "number" ? lineCount : (content === "" ? 0 : content.split("\n").length);
+    const tooLarge = (limits.maxBytes > 0 && bytes > limits.maxBytes) || (limits.maxLines > 0 && lines > limits.maxLines);
+    return tooLarge ? { bytes, lineCount: lines } : undefined;
+}
+function sourceTooLarge(content, lineCount, limits, args) {
+    const size = exceedsSourceLimits(content, lineCount, limits);
+    return size ? sourceTooLargeError(args, size, limits) : undefined;
+}
+function sourceTooLargeError(args, size, limits, extra = {}) {
+    const name = `${String(args?.library || "").toUpperCase()}/${String(args?.sourceFile || "").toUpperCase()}(${String(args?.member || "").toUpperCase()})`;
+    return toolError(`${name} is too large for a full read (${size.lineCount ?? "?"} lines` +
+        `${typeof size.bytes === "number" ? `, ${size.bytes} bytes` : ""}; limits ${limits.maxLines} lines, ${limits.maxBytes} bytes). ` +
+        "Read it in pieces with startLine/endLine or ranges, locate code with ibmi.search.members or ibmi.source.inspect " +
+        "(search, outline), or use metadataOnly: true for its size and version.", { code: "SOURCE_TOO_LARGE", ...size, maxLines: limits.maxLines, maxBytes: limits.maxBytes, ...extra });
+}
+function formatMemberReadResult(snapshot, args, limits) {
+    if (isFullMemberRead(args)) {
+        const size = exceedsSourceLimits(snapshot.content, snapshot.lines.length, limits);
+        if (size) {
+            return sourceTooLargeError(args, size, limits, {
+                identity: snapshot.identity,
+                metadata: snapshot.metadata,
+                version: snapshot.version,
+                sha256: snapshot.sha256,
+                observedAt: snapshot.observedAt
+            });
         }
+    }
+    return json(formatMemberRead(snapshot, args, limits));
+}
+function memberMetadataEnvelope(args, metadata, observedAt) {
+    return {
+        status: "found",
+        identity: {
+            library: String(args.library).toUpperCase(),
+            sourceFile: String(args.sourceFile).toUpperCase(),
+            member: String(args.member).toUpperCase()
+        },
+        metadata,
+        ...(metadata?.lastChanged ? { changeMarker: metadata.lastChanged } : {}),
+        observedAt,
+        contentLoaded: false,
+        cacheStatus: "bypass",
+        warnings: [
+            "Content was not downloaded, so sha256 and version are omitted. Pass expectedVersion/expectedSha256 or read without metadataOnly to compute them."
+        ]
     };
-    tn5250Sessions.set(connectionName, session);
-    return session;
 }
-function requireTn5250Session(ctx, args) {
-    const name = resolveTn5250SessionName(ctx, args);
-    if (!name)
-        throw new Error("connectionName is required (no active session)");
-    const session = tn5250Sessions.get(name);
-    if (!session) {
-        throw new Error(`TN5250 session for ${name} not found. Call ibmi.tn5250.connect first.`);
+async function describeWrittenMember(conn, args, previous) {
+    const identity = {
+        library: String(args.library).toUpperCase(),
+        sourceFile: String(args.sourceFile).toUpperCase(),
+        member: String(args.member).toUpperCase()
+    };
+    const base = {
+        status: "written",
+        identity,
+        modified: true,
+        ...(previous ? { previousVersion: previous.version, previousSha256: previous.sha256 } : {})
+    };
+    try {
+        // Read back what the host stored (record length and CCSID conversion may
+        // differ from what was sent) so the caller can chain the next edit.
+        const snapshot = await conn.content.getMemberSnapshot(args.library, args.sourceFile, args.member, true);
+        return {
+            ...base,
+            version: snapshot.version,
+            sha256: snapshot.sha256,
+            lineCount: snapshot.lines.length,
+            observedAt: snapshot.observedAt
+        };
+    }
+    catch (error) {
+        return { ...base, warnings: [`Write succeeded, but reading back the new version failed: ${error?.message || String(error)}`] };
     }
-    return session;
 }
-function resolveTn5250SessionName(ctx, args) {
-    return args?.connectionName || ctx.activeName;
+function formatMemberRead(snapshot, args, limits) {
+    const envelope = {
+        status: "found",
+        identity: snapshot.identity,
+        metadata: snapshot.metadata,
+        version: snapshot.version,
+        sha256: snapshot.sha256,
+        observedAt: snapshot.observedAt,
+        ...(snapshot.validatedAt ? { validatedAt: snapshot.validatedAt } : {}),
+        complete: snapshot.complete,
+        transport: snapshot.transport,
+        cacheStatus: snapshot.cacheStatus,
+        lineCount: snapshot.lines.length,
+        warnings: snapshot.warnings
+    };
+    if (args?.metadataOnly)
+        return envelope;
+    const selection = normalizeLineRanges(args, snapshot.lines.length);
+    if (!selection.requested) {
+        const size = limits ? exceedsSourceLimits(snapshot.content, snapshot.lines.length, limits) : undefined;
+        if (size) {
+            // Composite inspect read_ranges without ranges: never flood the caller.
+            return {
+                ...envelope,
+                contentOmitted: true,
+                ...size,
+                warnings: [...snapshot.warnings, "Member exceeds the full-read size limit; request ranges instead."]
+            };
+        }
+        return { ...envelope, content: snapshot.content };
+    }
+    return {
+        ...envelope,
+        warnings: [...snapshot.warnings, ...selection.warnings],
+        ...(selection.truncated ? { truncated: true, nextLine: selection.nextLine } : {}),
+        ranges: selection.ranges.map(range => ({
+            start: range.start,
+            end: range.end,
+            lines: snapshot.lines.slice(range.start - 1, range.end).map((content, index) => ({
+                number: range.start + index,
+                content
+            }))
+        }))
+    };
 }
-function findTn5250Field(session, fieldId) {
-    const normalized = String(fieldId || "").trim().toLowerCase();
-    if (!normalized)
-        return undefined;
-    const aliases = normalized === "1" ? ["command", "1"] : [normalized];
-    return session.screen.fields.find(field => {
-        const id = field.id.toLowerCase();
-        return aliases.includes(id);
-    });
+function normalizeLineRanges(args, lineCount) {
+    const before = clampInteger(args?.before, 0, 200, 0);
+    const after = clampInteger(args?.after, 0, 200, 0);
+    const requested = [];
+    if (typeof args?.startLine !== "undefined" || typeof args?.endLine !== "undefined") {
+        const start = typeof args.startLine !== "undefined" ? Number(args.startLine) : 1;
+        // startLine without endLine reads to the end of the member.
+        const end = typeof args.endLine !== "undefined" ? Number(args.endLine) : Math.max(start, lineCount);
+        requested.push({ start, end });
+    }
+    if (Array.isArray(args?.ranges)) {
+        for (const range of args.ranges.slice(0, 8))
+            requested.push({ start: Number(range.start), end: Number(range.end) });
+    }
+    const warnings = [];
+    if (requested.length === 0)
+        return { requested: false, ranges: [], warnings, truncated: false };
+    const normalized = [];
+    for (const range of requested) {
+        if (!Number.isFinite(range.start) || !Number.isFinite(range.end) || range.start < 1 || range.end < range.start) {
+            throw new Error(`Invalid line range ${range.start}-${range.end}`);
+        }
+        const start = Math.max(1, Math.floor(range.start) - before);
+        const end = Math.min(lineCount, Math.floor(range.end) + after);
+        if (start > lineCount || end < start) {
+            warnings.push(`Lines ${range.start}-${range.end} are past the end of the member (${lineCount} lines).`);
+            continue;
+        }
+        normalized.push({ start, end });
+    }
+    normalized.sort((a, b) => a.start - b.start || a.end - b.end);
+    const merged = [];
+    for (const range of normalized) {
+        const previous = merged.at(-1);
+        if (previous && range.start <= previous.end + 1)
+            previous.end = Math.max(previous.end, range.end);
+        else
+            merged.push({ ...range });
+    }
+    // Cap the response instead of failing; nextLine says where to continue.
+    const limited = [];
+    let remaining = MAX_RANGE_LINES;
+    let nextLine;
+    for (const range of merged) {
+        if (remaining <= 0) {
+            nextLine ??= range.start;
+            break;
+        }
+        const length = range.end - range.start + 1;
+        if (length > remaining) {
+            limited.push({ start: range.start, end: range.start + remaining - 1 });
+            nextLine = range.start + remaining;
+            remaining = 0;
+            continue;
+        }
+        limited.push(range);
+        remaining -= length;
+    }
+    if (nextLine !== undefined) {
+        warnings.push(`Response limited to ${MAX_RANGE_LINES} lines; continue from line ${nextLine}.`);
+    }
+    return { requested: true, ranges: limited, warnings, truncated: nextLine !== undefined, nextLine };
 }
-function parseTn5250Keys(value) {
-    const raw = String(value || "").trim();
-    if (!raw)
-        throw new Error("keys is required");
-    return raw
-        .split(/[,\s+]+/)
-        .map(part => part.trim().toUpperCase())
-        .filter(Boolean);
-}
-function touchTn5250Session(session) {
-    session.screen.updatedAt = new Date().toISOString();
-    tn5250Sessions.set(session.connectionName, session);
-}
-function appendTn5250Message(session, message) {
-    session.screen.textLines.unshift(message);
-    if (session.screen.textLines.length > TN5250_MAX_LINES) {
-        session.screen.textLines = session.screen.textLines.slice(0, TN5250_MAX_LINES);
-    }
-    touchTn5250Session(session);
-}
-function resetTn5250Screen(session, message) {
-    const commandField = findTn5250Field(session, "command");
-    if (commandField)
-        commandField.value = "";
-    session.screen.textLines = [message, `Connected to ${session.connectionName}.`];
-    session.screen.cursorFieldId = "command";
-    session.screen.lastKeys = [];
-    touchTn5250Session(session);
-}
-function rotateTn5250Cursor(session) {
-    const fields = session.screen.fields;
-    if (fields.length === 0)
+function normalizeSearchTerms(args) {
+    const terms = [
+        ...(typeof args?.term === "string" ? [args.term] : []),
+        ...(Array.isArray(args?.terms) ? args.terms : [])
+    ].map(value => String(value)).filter(value => value.length > 0);
+    const unique = [...new Set(terms)];
+    if (unique.length < 1 || unique.length > 20)
+        throw new Error("Provide term or between 1 and 20 terms");
+    return unique;
+}
+function rankMemberCandidates(candidates, preferredFiles) {
+    if (!preferredFiles?.length)
         return;
-    const idx = fields.findIndex(field => field.id === session.screen.cursorFieldId);
-    const next = idx >= 0 ? (idx + 1) % fields.length : 0;
-    session.screen.cursorFieldId = fields[next].id;
-    touchTn5250Session(session);
-}
-async function waitForTn5250Text(session, text, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    const needle = String(text).toLowerCase();
-    while (Date.now() <= deadline) {
-        const haystack = renderTn5250Screen(session.screen).toLowerCase();
-        if (haystack.includes(needle))
-            return true;
-        await new Promise(resolve => setTimeout(resolve, 200));
-    }
-    return false;
-}
-function renderTn5250Screen(screen) {
-    const lines = [];
-    lines.push(`${screen.title} (${screen.status})`);
-    lines.push(...screen.textLines);
-    for (const field of screen.fields) {
-        lines.push(`${field.label}[${field.id}]=${field.value}`);
+    const ranks = new Map(preferredFiles.map((value, index) => [String(value).toUpperCase(), index]));
+    candidates.sort((a, b) => (ranks.get(String(a.file).toUpperCase()) ?? Number.MAX_SAFE_INTEGER) -
+        (ranks.get(String(b.file).toUpperCase()) ?? Number.MAX_SAFE_INTEGER) || String(a.file).localeCompare(String(b.file)));
+}
+function inspectMemberOperation(snapshot, operation, limits) {
+    switch (operation.operation) {
+        case "metadata":
+            return { operation: "metadata", metadata: snapshot.metadata };
+        case "read_ranges":
+            return { operation: "read_ranges", ...formatMemberRead(snapshot, { ranges: operation.ranges, before: operation.before, after: operation.after }, limits) };
+        case "search":
+            return { operation: "search", ...searchSnapshot(snapshot, operation) };
+        case "outline":
+            return { operation: "outline", language: sourceLanguageOf(snapshot), symbols: outlineSnapshot(snapshot) };
+        case "dependencies":
+            return { operation: "dependencies", language: sourceLanguageOf(snapshot), dependencies: dependenciesFromSnapshot(snapshot) };
+        default:
+            throw new Error(`Unsupported inspection operation: ${operation.operation}`);
+    }
+}
+function searchSnapshot(snapshot, operation) {
+    const terms = normalizeSearchTerms({ term: operation.query, terms: operation.terms });
+    const before = clampInteger(operation.before, 0, 50, 0);
+    const after = clampInteger(operation.after, 0, 50, 0);
+    const maxMatches = clampInteger(operation.maxMatches, 1, 1_000, 100);
+    const lowered = terms.map(term => term.toLowerCase());
+    const matches = [];
+    for (let index = 0; index < snapshot.lines.length && matches.length < maxMatches; index++) {
+        const line = snapshot.lines[index];
+        const matchedTerms = terms.filter((_term, termIndex) => line.toLowerCase().includes(lowered[termIndex]));
+        if (matchedTerms.length === 0)
+            continue;
+        const start = Math.max(0, index - before);
+        const end = Math.min(snapshot.lines.length - 1, index + after);
+        matches.push({
+            line: index + 1,
+            content: line,
+            matchedTerms,
+            context: snapshot.lines.slice(start, end + 1).map((content, contextIndex) => ({ number: start + contextIndex + 1, content }))
+        });
     }
-    return lines.join("\n");
+    return { terms, matches, returned: matches.length, truncated: matches.length >= maxMatches };
+}
+function outlineSnapshot(snapshot) {
+    return inspectSource(snapshot.lines, snapshot.metadata?.extension).symbols;
+}
+function dependenciesFromSnapshot(snapshot) {
+    return inspectSource(snapshot.lines, snapshot.metadata?.extension).dependencies;
+}
+function sourceLanguageOf(snapshot) {
+    return detectSourceLanguage(snapshot.metadata?.extension, snapshot.lines);
+}
+async function readSystemFacts(conn) {
+    if (conn.__mcpSystemFacts)
+        return conn.__mcpSystemFacts;
+    try {
+        const rows = await conn.runSQL("select OS_VERSION, OS_RELEASE, HOST_NAME, current_user as EFFECTIVE_USER " +
+            "from SYSIBMADM.ENV_SYS_INFO fetch first 1 row only");
+        const row = rows[0];
+        const version = String(row?.OS_VERSION || "").replace(/\D/g, "");
+        const release = String(row?.OS_RELEASE || "").replace(/\D/g, "");
+        const facts = {
+            ...(version && release ? { release: `${Number(version)}.${Number(release)}` } : {}),
+            ...(row?.EFFECTIVE_USER ? { effectiveUser: String(row.EFFECTIVE_USER).trim() } : {}),
+            ...(row?.HOST_NAME ? { systemName: String(row.HOST_NAME).trim() } : {})
+        };
+        conn.__mcpSystemFacts = facts;
+        return facts;
+    }
+    catch {
+        // Older IBM i releases may not expose SYSIBMADM.ENV_SYS_INFO.
+    }
+    return {};
+}
+export function clampInteger(value, minimum, maximum, fallback) {
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed))
+        return fallback;
+    return Math.max(minimum, Math.min(maximum, Math.floor(parsed)));
 }
 function rejectCredentialArgs(args, toolName) {
     if (!args || typeof args !== "object")
@@ -3075,19 +3703,19 @@ function rejectCredentialArgs(args, toolName) {
         throw new Error(`${toolName} does not accept storePassword. Credentials must be managed via local control-plane UI.`);
     }
 }
-function result(text) {
+export function result(text) {
     return {
         content: [{ type: "text", text }],
         structuredContent: { ok: true, text }
     };
 }
-function json(obj) {
+export function json(obj) {
     return {
         content: [{ type: "text", text: JSON.stringify(obj, null, 2) }],
         structuredContent: { ok: true, data: obj }
     };
 }
-function toolError(message, error) {
+export function toolError(message, error) {
     return {
         isError: true,
         content: [{ type: "text", text: message }],
@@ -3100,13 +3728,179 @@ function toolError(message, error) {
         }
     };
 }
-function getConnectionName(ctx, args) {
+export function jsonError(message, obj) {
+    return {
+        isError: true,
+        content: [{ type: "text", text: `${message}\n${JSON.stringify(obj, null, 2)}` }],
+        structuredContent: {
+            ok: false,
+            data: obj,
+            error: { message }
+        }
+    };
+}
+// Returns the payload as normal JSON when the command worked and as a tool
+// error (isError) when it did not, so agents can't mistake a failure for "OK".
+export function commandOutcome(payload) {
+    if (payload.ok)
+        return json(payload);
+    const detail = String(payload.stderr || "").trim().split(/\r?\n/)[0] || "";
+    const label = payload.command ? `Command failed: ${payload.command}` : "Command failed";
+    return jsonError(detail ? `${label} (${detail})` : label, payload);
+}
+export function requireCommandSuccess(res, label) {
+    if (!res || res.code !== 0) {
+        const detail = String(res?.stderr || res?.stdout || "").trim();
+        throw new Error(`${label} failed (exit ${res?.code ?? "unknown"})${detail ? `: ${detail}` : ""}`);
+    }
+    return res;
+}
+const IFS_READ_DEFAULT_MAX_BYTES = 1024 * 1024;
+const IFS_READ_HARD_MAX_BYTES = 16 * 1024 * 1024;
+// Size of an IFS stream file from `ls -ldL`, or undefined when it can't be
+// determined (the download is then checked after the fact).
+export async function statIfsFileSize(conn, remotePath) {
+    try {
+        const res = await conn.sendCommand({ command: `ls -ldL ${Tools.escapePath(remotePath)}` });
+        if (!res || res.code !== 0)
+            return undefined;
+        const parts = String(res.stdout || "").trim().split(/\s+/);
+        if (parts.length < 5 || parts[0].startsWith("d"))
+            return undefined;
+        const size = Number(parts[4]);
+        return Number.isFinite(size) && size >= 0 ? size : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// Decodes data as UTF-8 text, or returns undefined when it is binary (contains
+// NUL bytes or is not valid UTF-8).
+export function decodeUtf8Text(data) {
+    if (data.includes(0))
+        return undefined;
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(data);
+    }
+    catch {
+        return undefined;
+    }
+}
+const SQL_TRAILING_ROW_CLAUSE = new RegExp("(?:fetch\\s+(?:first|next)\\s+(?:\\S+\\s+)?rows?\\s+only" +
+    "|for\\s+(?:read|fetch)\\s+only" +
+    "|for\\s+update(?:\\s+of\\s+[\\w\\s,\"]+)?" +
+    "|optimize\\s+for\\s+\\S+\\s+rows?" +
+    "|with\\s+(?:nc|ur|cs|rs|rr)(?:\\s+keep\\s+(?:update|exclusive|share)\\s+locks)?" +
+    "|limit\\s+\\S+(?:\\s+offset\\s+\\S+)?" +
+    "|offset\\s+\\S+\\s+rows?" +
+    "|skip\\s+locked\\s+data|use\\s+currently\\s+committed|wait\\s+for\\s+outcome)$");
+// Adds FETCH FIRST n ROWS ONLY to a SELECT/WITH query so the row cap is applied
+// on the IBM i. Queries that already end with a row-limiting, locking or
+// isolation clause are left unchanged (the client-side slice still applies).
+function applySqlRowCap(sql, rowLimit) {
+    const body = sql.replace(/[\s;]+$/, "");
+    const normalized = body
+        .replace(/\/\*[\s\S]*?\*\//g, " ")
+        .split("\n")
+        .map(line => line.replace(/--.*$/, ""))
+        .join(" ")
+        .replace(/\s+/g, " ")
+        .trim()
+        .toLowerCase();
+    if (!/^(?:select|with)\b/.test(normalized))
+        return { sql, applied: false };
+    if (SQL_TRAILING_ROW_CLAUSE.test(normalized))
+        return { sql, applied: false };
+    return { sql: `${body}\nfetch first ${Math.max(1, Math.floor(rowLimit))} rows only`, applied: true };
+}
+function requireSpoolJobFilter(value) {
+    const raw = String(value || "").trim().toUpperCase();
+    return raw.includes("/") ? requireJobName(raw) : requireIbmObjectName(raw, "jobName");
+}
+export function requireObjectTypeValue(value, label) {
+    const objectType = String(value || "").trim().toUpperCase();
+    if (!/^\*[A-Z]{2,9}$/.test(objectType))
+        throw new Error(`Invalid ${label}: ${value}`);
+    return objectType;
+}
+// SNDMSG only sends *INFO and *INQ messages; *COMP and *DIAG need SNDPGMMSG.
+function buildSendMessageCommand(message, library, messageQueue, messageType) {
+    const queue = `${library}/${messageQueue}`;
+    switch (messageType) {
+        case "*INQ":
+            return `SNDMSG MSG(${quoteClString(message)}) TOMSGQ(${queue}) MSGTYPE(*INQ) RPYMSGQ(${queue})`;
+        case "*COMP":
+        case "*DIAG":
+            return `SNDPGMMSG MSG(${quoteClString(message)}) TOMSGQ(${queue}) MSGTYPE(${messageType})`;
+        default:
+            return `SNDMSG MSG(${quoteClString(message)}) TOMSGQ(${queue}) MSGTYPE(*INFO)`;
+    }
+}
+// CALL to the Send Data Queue (QSNDDTAQ) API with explicitly typed parameters:
+// queue name CHAR(10), library CHAR(10), data length DEC(5,0), data.
+function buildQsnddtaqCall(library, queue, message) {
+    if (/[^\x20-\x7E]/.test(message)) {
+        throw new Error("QSYS2.SEND_DATA_QUEUE is not available and the QSNDDTAQ fallback only supports printable single-byte text.");
+    }
+    if (message.length > 5000) {
+        throw new Error("QSYS2.SEND_DATA_QUEUE is not available and the QSNDDTAQ fallback is limited to 5000 characters.");
+    }
+    const length = message.length;
+    return `CALL PGM(QSYS/QSNDDTAQ) PARM((${quoteClString(queue)} (*CHAR 10)) (${quoteClString(library)} (*CHAR 10)) ` +
+        `(${length} (*DEC 5 0)) (${quoteClString(message)} (*CHAR ${length})))`;
+}
+// Formats CHGDTAARA for the data area's type: *DEC takes an unquoted number and
+// *LGL takes '0' or '1' (neither allows a substring); *CHAR keeps the
+// substring form so only the given positions change.
+function buildChangeDataAreaCommand(library, dataArea, value, info, args) {
+    const target = `${library}/${dataArea}`;
+    const type = String(info?.type || "*CHAR").trim().toUpperCase();
+    const substringRequested = args?.startPosition !== undefined || args?.length !== undefined;
+    if (type === "*DEC") {
+        if (substringRequested)
+            throw new Error("startPosition and length are only valid for *CHAR data areas");
+        const text = value.trim();
+        const match = text.match(/^([+-]?)(\d*)(?:\.(\d*))?$/);
+        if (!match || (match[2] === "" && !match[3]))
+            throw new Error(`Value for *DEC data area must be numeric: ${value}`);
+        const intDigits = match[2].replace(/^0+(?=\d)/, "");
+        const fraction = match[3] || "";
+        const decimals = typeof info?.decimalPositions === "number" ? info.decimalPositions : undefined;
+        const totalDigits = typeof info?.length === "number" ? info.length : undefined;
+        if (decimals !== undefined && fraction.replace(/0+$/, "").length > decimals) {
+            throw new Error(`Value has more than ${decimals} decimal positions`);
+        }
+        if (totalDigits !== undefined && decimals !== undefined && intDigits.replace(/^0+/, "").length > totalDigits - decimals) {
+            throw new Error(`Value does not fit a *DEC ${totalDigits} ${decimals} data area`);
+        }
+        const formatted = `${match[1] === "-" ? "-" : ""}${intDigits || "0"}${fraction ? `.${fraction}` : ""}`;
+        return `CHGDTAARA DTAARA(${target}) VALUE(${formatted})`;
+    }
+    if (type === "*LGL") {
+        if (substringRequested)
+            throw new Error("startPosition and length are only valid for *CHAR data areas");
+        const normalized = value.trim().toLowerCase();
+        const logical = ["1", "true", "*on", "on", "yes"].includes(normalized)
+            ? "1"
+            : ["0", "false", "*off", "off", "no"].includes(normalized) ? "0" : undefined;
+        if (!logical)
+            throw new Error(`Value for *LGL data area must be 0 or 1: ${value}`);
+        return `CHGDTAARA DTAARA(${target}) VALUE('${logical}')`;
+    }
+    const startPosition = clampNumber(args?.startPosition, 1, 1, 2000);
+    const length = clampNumber(args?.length, Math.max(value.length, 1), 1, 2000);
+    if (typeof info?.length === "number" && info.length > 0 && startPosition + length - 1 > info.length) {
+        throw new Error(`Positions ${startPosition} to ${startPosition + length - 1} are outside the ${info.length}-character data area`);
+    }
+    return `CHGDTAARA DTAARA(${target} (${startPosition} ${length})) VALUE(${quoteClString(value)})`;
+}
+export function getConnectionName(ctx, args) {
     const name = args?.connectionName || ctx.activeName;
     if (!name)
         throw new Error("connectionName is required (no active connection)");
     return name;
 }
-function requireQsysName(conn, value, label) {
+export function requireQsysName(conn, value, label) {
     const raw = String(value || "").trim().toUpperCase();
     if (!raw)
         throw new Error(`${label} is required`);
@@ -3151,7 +3945,7 @@ function requireMessageKey(value) {
     }
     throw new Error(`Invalid messageKey: ${value}`);
 }
-async function updateConnectionSettings(ctx, name, update) {
+export async function updateConnectionSettings(ctx, name, update) {
     const conn = await ctx.store.getConnection(name);
     if (!conn)
         throw new Error(`Connection ${name} not found`);
@@ -3165,21 +3959,52 @@ async function updateConnectionSettings(ctx, name, update) {
         // No active session for this connection.
     }
 }
-async function applyLibraryList(conn, libraryList, currentLibrary) {
+/**
+ * applyToJob: puts the library list in effect now. A connected client applies
+ * its configured list (which the caller has just updated) to the persistent
+ * SQL job, or checks it for the per-call QZDFMDB2 and qsh jobs; libraries that
+ * do not exist are left out and reported in `warning` instead of failing.
+ */
+export async function applyLibraryList(conn, libraryList, currentLibrary) {
+    const names = [...(libraryList || []), ...(currentLibrary ? [currentLibrary] : [])].map(l => String(l).toUpperCase());
+    const invalid = names.find(l => !conn.validQsysName(l));
+    if (invalid)
+        throw new Error(`Invalid library name: ${invalid}`);
+    if (typeof conn.applyConfiguredLibraryList === "function") {
+        const applied = await conn.applyConfiguredLibraryList();
+        return applied?.warning ? { warning: applied.warning } : {};
+    }
     if (libraryList && libraryList.length > 0) {
         const normalized = libraryList.map((l) => String(l).toUpperCase());
         const invalid = normalized.find((l) => !conn.validQsysName(l));
         if (invalid)
             throw new Error(`Invalid library name: ${invalid}`);
-        const libs = normalized.join(" ");
-        await conn.sendQsh({ command: `system \"CHGLIBL LIBL(${libs})\"` });
+        if (typeof conn.runCL === "function") {
+            // Runs in the persistent SQL job when there is one, so later SQL and CL see it.
+            requireCommandSuccess(await conn.runCL(`CHGLIBL LIBL(${normalized.join(" ")})`), "CHGLIBL");
+        }
+        else {
+            // '$' is escaped so names like $LIB are not expanded by qsh.
+            const libs = normalized.join(" ").replace(/\$/g, "\\$");
+            requireCommandSuccess(await conn.sendQsh({ command: `system \"CHGLIBL LIBL(${libs})\"` }), "CHGLIBL");
+        }
     }
     if (currentLibrary) {
         const lib = String(currentLibrary).toUpperCase();
         if (!conn.validQsysName(lib))
             throw new Error(`Invalid current library: ${lib}`);
-        await conn.sendQsh({ command: `system \"CHGCURLIB ${lib}\"` });
+        if (typeof conn.runCL === "function") {
+            requireCommandSuccess(await conn.runCL(`CHGCURLIB CURLIB(${lib})`), "CHGCURLIB");
+        }
+        else {
+            requireCommandSuccess(await conn.sendQsh({ command: `system \"CHGCURLIB ${lib.replace(/\$/g, "\\$")}\"` }), "CHGCURLIB");
+        }
     }
+    return {};
+}
+/** "OK", plus the library list warning from applyToJob when there is one. */
+function okApplied(applied, text = "OK") {
+    return result(applied?.warning ? `${text}. Warning: ${applied.warning}` : text);
 }
 function stripUndefined(obj) {
     const out = {};
@@ -3247,6 +4072,42 @@ async function compareDeployTrees(conn, localRoot, remoteRoot) {
         }
     };
 }
+/**
+ * Re-checks every file present on both sides by SHA-256, so files with equal
+ * size but different content count as changed and size-unknown files are
+ * resolved. Files whose remote hash can't be computed stay unresolved.
+ */
+async function refineComparisonByHash(conn, comparison) {
+    const sizeOf = new Map();
+    for (const entry of [...comparison.changed, ...comparison.unresolved])
+        sizeOf.set(entry.path, entry);
+    const shared = [...comparison.identical, ...comparison.changed.map(e => e.path), ...comparison.unresolved.map(e => e.path)]
+        .sort((a, b) => a.localeCompare(b));
+    const remoteHashes = await sha256RemoteFiles(conn, comparison.remoteRoot, shared);
+    const identical = [];
+    const changed = [];
+    const unresolved = [];
+    for (const rel of shared) {
+        const sizes = sizeOf.get(rel);
+        const localSha256 = await sha256LocalFile(path.join(comparison.localRoot, rel));
+        const remoteSha256 = remoteHashes.get(rel);
+        const base = { path: rel, localSize: sizes?.localSize, remoteSize: sizes?.remoteSize, localSha256, remoteSha256 };
+        if (!remoteSha256)
+            unresolved.push({ ...base, reason: "hash_unavailable" });
+        else if (remoteSha256 === localSha256)
+            identical.push(rel);
+        else
+            changed.push({ ...base, reason: "content_mismatch" });
+    }
+    return {
+        ...comparison,
+        comparedBy: "sha256",
+        identical,
+        changed,
+        unresolved,
+        summary: { ...comparison.summary, identical: identical.length, changed: changed.length, unresolved: unresolved.length }
+    };
+}
 async function listLocalFiles(root) {
     const resolvedRoot = path.resolve(root);
     const results = new Map();
@@ -3271,6 +4132,10 @@ async function listRemoteFiles(conn, remoteRoot) {
     const normalizedRoot = remoteRoot.replace(/\/$/, "");
     const find = conn.remoteFeatures.find || "/QOpenSys/pkgs/bin/find";
     const stat = conn.remoteFeatures.stat;
+    // A remote root that does not exist yet is an empty tree (first deploy).
+    const exists = await conn.sendCommand({ command: `test -d ${Tools.escapePath(normalizedRoot)}` });
+    if (exists.code !== 0)
+        return new Map();
     if (stat) {
         const statCmd = `${find} ${Tools.escapePath(normalizedRoot)} -type f -exec ${stat} -c '%n|%s' {} \\;`;
         const statRes = await conn.sendCommand({ command: statCmd });
@@ -3321,7 +4186,7 @@ function joinRemotePath(root, rel) {
     const base = root.replace(/\/$/, "");
     return `${base}/${rel}`.replace(/\\/g, "/");
 }
-function mapActionExecution(action, targetType, targetPath, result) {
+export function mapActionExecution(action, targetType, targetPath, result) {
     const diagnostics = normalizeCommandDiagnostics(result);
     const code = Number(result?.code);
     const ok = Number.isFinite(code) ? code === 0 : false;
@@ -3385,32 +4250,60 @@ function normalizeJoblogRow(row) {
         timestamp: row.MESSAGE_TIMESTAMP ? String(row.MESSAGE_TIMESTAMP) : undefined
     };
 }
-function normalizeSpoolEntry(row) {
+export function normalizeSpoolEntry(row) {
     return {
         ...row,
         source: "spool",
-        jobName: toNullableString(pickFirst(row, ["JOB_NAME", "JOB"])) || "",
+        jobName: toNullableString(pickFirst(row, ["QUALIFIED_JOB_NAME", "JOB_NAME", "JOB"])) || "",
         spooledFileName: toNullableString(pickFirst(row, ["SPOOLED_FILE_NAME", "SPOOLED_FILE", "SPLF_NAME"])) || "",
         spooledFileNumber: toNullableNumber(pickFirst(row, ["SPOOLED_FILE_NUMBER", "SPLF_NUMBER", "FILE_NUMBER"])),
         outputQueue: toNullableString(pickFirst(row, ["OUTPUT_QUEUE_NAME", "OUTQ_NAME", "OUTPUT_QUEUE"])) || "",
+        outputQueueLibrary: toNullableString(pickFirst(row, ["OUTPUT_QUEUE_LIBRARY_NAME", "OUTPUT_QUEUE_LIBRARY"])) || "",
+        userName: toNullableString(pickFirst(row, ["USER_NAME", "JOB_USER"])) || "",
+        createdAt: toNullableString(pickFirst(row, ["CREATE_TIMESTAMP", "CREATION_TIMESTAMP"])),
         totalPages: toNullableNumber(pickFirst(row, ["TOTAL_PAGES", "PAGES"])),
         status: toNullableString(pickFirst(row, ["FILE_STATUS", "STATUS"])) || ""
     };
 }
-function normalizeSpoolLine(row) {
+export function normalizeSpoolLine(row) {
+    const position = pickFirst(row, ["ORDINAL_POSITION", "LINE_NUMBER"]);
     return {
         ...row,
         source: "spool",
-        lineNumber: Number.isFinite(Number(row.LINE_NUMBER)) ? Number(row.LINE_NUMBER) : null,
-        text: String(row.SPOOLED_DATA || "")
+        lineNumber: Number.isFinite(Number(position)) && position !== null && position !== "" ? Number(position) : null,
+        text: String(row.SPOOLED_DATA ?? "")
     };
 }
-function clampNumber(value, fallback, min, max) {
+export function clampNumber(value, fallback, min, max) {
     const n = Number(value);
     if (!Number.isFinite(n))
         return fallback;
     return Math.max(min, Math.min(max, Math.floor(n)));
 }
+/**
+ * Runs SQL with a time limit. When the limit is reached the call fails and the
+ * signal asks the client to cancel the statement in its persistent SQL job, so
+ * it does not keep running on the IBM i.
+ */
+async function runSqlWithTimeout(conn, sql, timeoutMs, timeoutMessage) {
+    const controller = new AbortController();
+    let timeoutHandle;
+    try {
+        return await Promise.race([
+            conn.runSQL(sql, { signal: controller.signal }),
+            new Promise((_, reject) => {
+                timeoutHandle = setTimeout(() => {
+                    controller.abort();
+                    reject(new Error(timeoutMessage));
+                }, timeoutMs);
+            })
+        ]);
+    }
+    finally {
+        if (timeoutHandle)
+            clearTimeout(timeoutHandle);
+    }
+}
 async function withTimeout(promise, timeoutMs, timeoutMessage) {
     let timeoutHandle;
     try {
@@ -3427,14 +4320,7 @@ async function withTimeout(promise, timeoutMs, timeoutMessage) {
     }
 }
 function getSqlStatementType(sql) {
-    const stripped = sql
-        .replace(/\/\*[\s\S]*?\*\//g, " ")
-        .split("\n")
-        .filter(line => !line.trim().startsWith("--"))
-        .join(" ")
-        .trim();
-    const token = stripped.split(/\s+/)[0] || "UNKNOWN";
-    return token.toUpperCase();
+    return parseSqlStatementType(sql);
 }
 function getRowColumns(rows) {
     if (!Array.isArray(rows) || rows.length === 0)
@@ -3442,6 +4328,10 @@ function getRowColumns(rows) {
     return Object.keys(rows[0] || {});
 }
 function inferAffectedRows(rows) {
+    // The persistent SQL job reports the update count of INSERT/UPDATE/DELETE.
+    const updateCount = rows?.updateCount;
+    if (typeof updateCount === "number" && Number.isFinite(updateCount))
+        return updateCount;
     if (!Array.isArray(rows) || rows.length === 0)
         return null;
     const candidateKeys = [
@@ -3486,37 +4376,126 @@ function toSafeSqlError(err, sql, timeoutMs) {
     };
 }
 function isReadOnlySql(sql) {
-    const stripped = sql
-        .replace(/\/\*[\s\S]*?\*\//g, " ")
-        .split("\n")
-        .filter(line => !line.trim().startsWith("--"))
-        .join(" ")
-        .trim()
-        .toLowerCase();
-    return stripped.startsWith("select ") || stripped.startsWith("with ") || stripped.startsWith("values ");
+    return checkReadOnlySql(sql).readOnly;
 }
-function enforceWritable(ctx, conn, operation, args) {
+export async function enforceWritable(ctx, conn, operation, args) {
     if (conn.getConfig().readOnlyMode)
         throw new Error("Connection is in read-only mode");
-    enforcePolicyOperation(ctx, operation, args);
+    await enforcePolicyOperation(ctx, operation, args);
 }
-function enforcePolicyOperation(ctx, operation, args) {
+/**
+ * Checks for input the person types themselves (the live 5250 view): read-only
+ * connections, the read-only profile and deny lists still apply, but there is
+ * no approval prompt, because the person is the one approving.
+ */
+export async function enforceWritableForPerson(ctx, conn, operation, args) {
+    if (conn.getConfig().readOnlyMode)
+        throw new Error("Connection is in read-only mode");
+    const policy = ctx.getPolicy(args?.connectionName);
+    if (policy.profile === "read-only")
+        throw new Error(`Blocked by policy (${policy.profile}): ${operation}`);
+    const deniedReason = isDeniedByPolicy(policy, operation, args);
+    if (deniedReason)
+        throw new Error(`Blocked by policy: ${operation} (${deniedReason})`);
+}
+async function enforcePolicyOperation(ctx, operation, args) {
     const policy = ctx.getPolicy(args?.connectionName);
     if (policy.profile === "read-only") {
         throw new Error(`Blocked by policy (${policy.profile}): ${operation}`);
     }
-    if (isDeniedByPolicy(policy, operation, args)) {
-        throw new Error(`Blocked by policy: ${operation}`);
+    const deniedReason = isDeniedByPolicy(policy, operation, args);
+    if (deniedReason) {
+        throw new Error(`Blocked by policy: ${operation} (${deniedReason})`);
+    }
+    if (policy.profile !== "guarded")
+        return;
+    // Shell text can do anything the profile can, so under guarded it always
+    // needs the person's say, whatever requireApprovalFor lists.
+    if (isShellOperation(args)) {
+        await requireConfirmation(ctx, policy, "shell.run", args, false);
+    }
+    else if (requiresApproval(policy, operation)) {
+        await requireConfirmation(ctx, policy, operation, args, operation !== "ifs.delete");
+    }
+}
+/**
+ * Get the person's approval for a guarded operation. With approvalMode
+ * "prompt" (the default) the MCP client asks them; the agent's approve flag
+ * counts for nothing. With "agent", approve=true is enough.
+ */
+export async function requireConfirmation(ctx, policy, operation, args, allowSession) {
+    if (policy.approvalMode === "agent") {
+        if (!Boolean(args?.approve)) {
+            throw new Error(`Operation '${operation}' requires approve=true under '${policy.profile}' policy.`);
+        }
+        return;
+    }
+    const connectionName = String(args?.connectionName || ctx.activeName || "");
+    const sessionKey = `${connectionName}\u0000${operation}`;
+    if (allowSession && ctx.sessionApprovals?.has(sessionKey))
+        return;
+    const unsupported = new Error(`Operation '${operation}' needs the user's confirmation, but this MCP client cannot show confirmation prompts. ` +
+        "Ask the user to run it from a client that supports MCP elicitation, or to set this connection's approval mode " +
+        "to \"agent\" in config.json (approve=true is then accepted).");
+    if (!ctx.confirm)
+        throw unsupported;
+    const answer = await ctx.confirm({
+        operation,
+        connectionName,
+        toolName: toolCallStore.getStore()?.toolName,
+        details: describeOperation(args),
+        allowSession
+    });
+    if (answer === "unsupported")
+        throw unsupported;
+    if (!answer.allowed) {
+        throw new Error(`Operation '${operation}' was not confirmed by the user, so it did not run.`);
     }
-    if (requiresApproval(policy, operation) && !Boolean(args?.approve)) {
-        throw new Error(`Operation '${operation}' requires approve=true under '${policy.profile}' policy.`);
+    if (allowSession && answer.forSession)
+        ctx.sessionApprovals?.add(sessionKey);
+}
+/**
+ * Approval for operations that always need it, whatever requireApprovalFor
+ * lists: under guarded the person is asked (no session allowance); other
+ * profiles keep the agent's approve=true.
+ */
+export async function requireDangerousApproval(ctx, operation, args, approveMessage) {
+    const policy = ctx.getPolicy(args?.connectionName);
+    if (policy.profile === "guarded") {
+        await requireConfirmation(ctx, policy, operation, args, false);
+        return;
     }
+    if (!Boolean(args?.approve))
+        throw new Error(approveMessage);
+}
+const DESCRIBED_ARG_KEYS = [
+    "command", "environment", "cwd", "sql",
+    "library", "file", "sourceFile", "member", "object", "type", "objectType", "name", "newName",
+    "path", "remotePath", "remoteDirectory", "targetPath", "localPath", "recursive", "confirmPath",
+    "deleteExtraRemote", "libraryList", "currentLibrary", "remove",
+    "confirmName", "journalLibrary", "journal", "retentionDays", "maxDeletes", "before"
+];
+/** Short plain-text lines describing the arguments that decide what runs. */
+export function describeOperation(args) {
+    const lines = [];
+    if (!args || typeof args !== "object")
+        return lines;
+    for (const key of DESCRIBED_ARG_KEYS) {
+        const value = args[key];
+        if (value === undefined || value === null || value === "")
+            continue;
+        let text = typeof value === "string" ? value : JSON.stringify(value);
+        if (text.length > 600)
+            text = `${text.substring(0, 600)}... (${text.length} characters)`;
+        lines.push(`${key}: ${text}`);
+    }
+    return lines;
 }
 function isMissingColumnError(err, column) {
     const message = String(err?.message || err || "").toUpperCase();
     return message.includes("42703") && message.includes(column.toUpperCase());
 }
-function requireIfsPath(value, label) {
+export function requireIfsPath(value, label) {
     const pathValue = String(value || "").trim();
     if (!pathValue.startsWith("/")) {
         throw new Error(`Invalid ${label}: must be an absolute IFS path`);
@@ -3533,10 +4512,10 @@ function requireIfsJournalObjectType(value) {
     }
     return objectType;
 }
-function quoteClString(value) {
+export function quoteClString(value) {
     return `'${String(value).replace(/'/g, "''")}'`;
 }
-function requireIbmObjectName(value, label) {
+export function requireIbmObjectName(value, label) {
     const name = String(value || "").trim().toUpperCase();
     if (!/^[A-Z#@$][A-Z0-9#@$]{0,9}$/.test(name)) {
         throw new Error(`Invalid ${label}: ${value}`);
@@ -3678,14 +4657,58 @@ function requiresApproval(policy, operation) {
     const requires = policy.requireApprovalFor || [];
     return requires.includes(operation);
 }
+/** Returns the reason an operation is denied by the command policy, if any. */
 function isDeniedByPolicy(policy, operation, args) {
-    const denyCommands = (policy.denyCommands || []).map(v => v.toLowerCase());
     if (operation === "cl.run" && args?.command) {
-        const command = String(args.command).toLowerCase();
-        if (denyCommands.some(prefix => command.startsWith(prefix)))
-            return true;
+        const environment = String(args.environment || "ile");
+        return environment === "ile"
+            ? checkClCommand(policy, String(args.command))
+            : checkShellCommand(policy, String(args.command));
+    }
+    if (typeof args?.sql === "string") {
+        return checkSqlEmbeddedCl(policy, args.sql);
+    }
+    return undefined;
+}
+/** Library, IFS path and embedded-CL policy checks that apply to every tool. */
+async function enforceResourcePolicy(ctx, toolName, args) {
+    const resolver = ctx;
+    const policy = typeof resolver.resolvePolicy === "function"
+        ? await resolver.resolvePolicy(args?.connectionName)
+        : typeof resolver.getPolicy === "function" ? resolver.getPolicy(args?.connectionName) : undefined;
+    if (!policy)
+        return;
+    const reason = checkResourcePolicy(policy, toolName, args);
+    if (reason) {
+        throw new Error(`Blocked by policy: ${toolName} (${reason})`);
+    }
+}
+/** Check the policy against an action's expanded command before it runs. */
+export function actionCommandGuard(ctx, environment, args) {
+    return async (expanded) => {
+        const policy = ctx.getPolicy(args?.connectionName);
+        const env = environment || "ile";
+        const reason = env === "ile"
+            ? checkClCommands(policy, expanded)
+            : checkShellCommand(policy, expanded);
+        if (reason)
+            throw new Error(`Blocked by policy: actions.run (${reason})`);
+        if (policy.profile === "guarded" && (env !== "ile" || clStartsShell(expanded))) {
+            await requireConfirmation(ctx, policy, "shell.run", { ...args, command: expanded, environment: env }, false);
+        }
+        return expanded;
+    };
+}
+/** Resolve a local path and refuse it outside the allowed local roots. */
+export async function guardLocalPath(ctx, value, mode) {
+    let settingsRoots;
+    try {
+        settingsRoots = (await ctx.store.getSettings())?.allowedLocalRoots;
+    }
+    catch {
+        settingsRoots = undefined;
     }
-    return false;
+    return resolveAllowedLocalPath(value, mode, configuredLocalRoots(settingsRoots));
 }
 const APPROVAL_HINT_TOOLS = new Set([
     "ibmi.qsys.members.write",
@@ -3742,11 +4765,32 @@ function withGuardedApprovalHint(tool) {
     if (!schema.properties.approve) {
         schema.properties.approve = {
             type: "boolean",
-            description: "Set true to approve guarded-policy operations."
+            description: "Only used when the connection's approvalMode is \"agent\". By default the user is asked to confirm guarded operations and this flag is ignored."
         };
     }
     return { ...tool, inputSchema: schema };
 }
+/** Tools outside the qsys/search/source families that also accept connectionName. */
+const CONNECTION_NAME_TOOLS = new Set([
+    "ibmi.find.ifs",
+    "ibmi.actions.run",
+    "ibmi.libl.validate",
+    "ibmi.resolve.path",
+    "ibmi.debug.status",
+    "ibmi.journal.objects.list"
+]);
+function withSourceConnectionName(tool) {
+    const accepts = /^ibmi\.(?:qsys|search|source|ifs|deploy)\./.test(tool.name) || CONNECTION_NAME_TOOLS.has(tool.name);
+    if (!accepts)
+        return tool;
+    const schema = tool.inputSchema || { type: "object", properties: {} };
+    if (!schema.properties)
+        schema.properties = {};
+    if (!schema.properties.connectionName) {
+        schema.properties.connectionName = { type: "string", description: "Saved IBM i connection name." };
+    }
+    return { ...tool, inputSchema: schema };
+}
 function withStrictInputSchema(tool) {
     const schema = strictifySchema(tool.inputSchema || { type: "object", properties: {} });
     return { ...tool, inputSchema: schema };
@@ -3775,33 +4819,10 @@ function isObjectSchema(schema) {
         return schema.type.includes("object");
     return schema.type === "object";
 }
-function resolveIfsWriteOperation(pathValue) {
+export function resolveIfsWriteOperation(pathValue) {
     const target = String(pathValue || "");
     if (/^\/qsys\.lib\//i.test(target)) {
         return "qsys.write";
     }
     return "ifs.write";
 }
-function parseEvfevent(content) {
-    const diagnostics = [];
-    for (const rawLine of content.split(/\r?\n/)) {
-        const line = rawLine.trimEnd();
-        if (!line.trim())
-            continue;
-        const match = line.match(/^\s*(\d+)\s+(\d+)\s+([A-Z0-9]+)\s+(INFO|WARN|ERROR)?\s*(.*)$/i);
-        if (match) {
-            diagnostics.push({
-                source: "evfevent",
-                line: Number(match[1]),
-                column: Number(match[2]),
-                code: match[3],
-                severity: (match[4] || "ERROR").toUpperCase(),
-                message: match[5] || line
-            });
-        }
-        else {
-            diagnostics.push({ source: "evfevent", severity: inferSeverity(line), message: line });
-        }
-    }
-    return diagnostics;
-}