memory-journal-mcp 9.0.0 → 9.1.0

package/dist/{chunk-IYZWMAA4.js → chunk-Y6MMKR2Z.js}

@@ -1,155 +1,24 @@
-import { logger, DatabaseAdapterFactory, runAutoPrune, AuditLogger, createAuditInterceptor, getGitHubIntegration, parseToolFilter, getFilterSummary, getToolFilterFromEnv, getAllToolNames, DEFAULT_BRIEFING_CONFIG, getTools, getRequiredScope, getResources, getPrompts, callTool, requestContextStorage, MetricsAccumulator, formatPrometheusMetrics, SUPPORTED_SCOPES, VERSION, logAgentIssue, validateResourceSubscription, getPrompt, readResource, getDummyHealingTools, TOOL_GROUPS, isValidScope, getEnabledGroups, generateCodeModeInstructions, generateStandardInstructions, enforceAccessBoundary, auditOperation, parseScopes, BASE_SCOPES } from './chunk-2UIMA6JF.js';
-import { sendProgress } from './chunk-ELMJYRTT.js';
-import { applyArgInterceptions } from './chunk-SP5D3XYY.js';
-import { runWithAuthContext } from './chunk-6RCZ4IYV.js';
+import { DUMMY_GREP_SEARCH_TOOL_NAMES, DUMMY_FILE_VIEW_TOOL_NAMES, DUMMY_DIR_LIST_TOOL_NAMES, TOOL_GROUPS, logger, DatabaseAdapterFactory, runAutoPrune, AuditLogger, createAuditInterceptor, getGitHubIntegration, parseToolFilter, getFilterSummary, getToolFilterFromEnv, getAllToolNames, DEFAULT_BRIEFING_CONFIG, getTools, globalSubscriptionManager, getRequiredScope, getResources, getPrompts, callTool, sendProgress, requestContextStorage, MetricsAccumulator, formatPrometheusMetrics, SUPPORTED_SCOPES, logAgentIssue, validateResourceSubscription, isValidScope, getEnabledGroups, generateCodeModeInstructions, generateStandardInstructions, enforceAccessBoundary, auditOperation, parseScopes, BASE_SCOPES, getPrompt, handlePrompt, handleReadResource, handleListResources, handleListPrompts, handleGetPrompt, DUMMY_SERVER_INFO_TOOL_NAMES, handleServerInfo, handleListAdapters, handleGrepSearch, handleViewFile, handleListDir, DUMMY_RESOURCE_TOOL_NAMES, DUMMY_LIST_RESOURCE_TOOL_NAMES, DUMMY_LIST_PROMPT_TOOL_NAMES, DUMMY_LIST_TOOL_NAMES, DUMMY_GET_PROMPT_TOOL_NAMES, DUMMY_PROJECT_TOOL_NAMES, DUMMY_ADAPTER_TOOL_NAMES, readResource } from './chunk-T7SROBBV.js';
+import { VERSION, applyArgInterceptions } from './chunk-SGJU2DHU.js';
+import { runWithAuthContext, getAuthContext } from './chunk-4FZCHFB5.js';
 import { MemoryJournalMcpError, ConfigurationError } from './chunk-E6IQP6PE.js';
 import { StdioServerTransport } from '@modelcontextprotocol/server/stdio';
-import { toNodeHandler, NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
-import { createMcpHandler, McpServer, ResourceTemplate } from '@modelcontextprotocol/server';
-import { randomUUID, createHash, timingSafeEqual } from 'crypto';
 import express from 'express';
+import { createHash, timingSafeEqual, randomUUID } from 'crypto';
 import 'https';
 import * as jose from 'jose';
 import { localhostHostValidation, hostHeaderValidation } from '@modelcontextprotocol/express';
+import { toNodeHandler, NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
+import { McpServer, createMcpHandler, ResourceTemplate } from '@modelcontextprotocol/server';
 import * as fs from 'fs';
 import * as path from 'path';
 import { loadSkills } from '@modelcontextprotocol/server/ext/skills/node';
+import * as dns from 'dns';
 import { EventEmitter } from 'events';
 import { parse, stringify } from 'yaml';
 import { z } from 'zod';
 import * as http from 'http';
 
-// src/server/subscription-manager.ts
-var SubscriptionManager = class {
-  // Map of Session ID (or 'stdio') -> McpServer instance
-  servers = /* @__PURE__ */ new Map();
-  // Map of URI string -> Set of Session IDs
-  subscriptions = /* @__PURE__ */ new Map();
-  /**
-   * Register a server instance for a session to allow sending notifications.
-   */
-  registerServer(sessionId, server) {
-    this.servers.set(sessionId, server);
-  }
-  /**
-   * Unregister a server instance and clean up its subscriptions.
-   */
-  unregisterServer(sessionId) {
-    this.servers.delete(sessionId);
-    this.unsubscribeSession(sessionId);
-  }
-  /**
-   * Subscribe a session to a resource URI.
-   */
-  subscribe(uri, sessionId) {
-    if (!sessionId) {
-      sessionId = "stdio";
-    }
-    let sessions = this.subscriptions.get(uri);
-    if (!sessions) {
-      sessions = /* @__PURE__ */ new Set();
-      this.subscriptions.set(uri, sessions);
-    }
-    if (!sessions.has(sessionId)) {
-      sessions.add(sessionId);
-      logger.debug(`Session ${sessionId} subscribed to resource ${uri}`, {
-        module: "SubscriptionManager"
-      });
-    }
-  }
-  /**
-   * Unsubscribe a session from a resource URI.
-   */
-  unsubscribe(uri, sessionId) {
-    if (!sessionId) {
-      sessionId = "stdio";
-    }
-    const sessions = this.subscriptions.get(uri);
-    if (sessions?.has(sessionId)) {
-      sessions.delete(sessionId);
-      logger.debug(`Session ${sessionId} unsubscribed from resource ${uri}`, {
-        module: "SubscriptionManager"
-      });
-      if (sessions.size === 0) {
-        this.subscriptions.delete(uri);
-      }
-    }
-  }
-  /**
-   * Unsubscribe a session from all resources (useful on transport disconnect).
-   */
-  unsubscribeSession(sessionId) {
-    let count = 0;
-    for (const [uri, sessions] of this.subscriptions.entries()) {
-      if (sessions.has(sessionId)) {
-        sessions.delete(sessionId);
-        count++;
-        if (sessions.size === 0) {
-          this.subscriptions.delete(uri);
-        }
-      }
-    }
-    if (count > 0) {
-      logger.debug(
-        `Session ${sessionId} disconnected, removed ${count} subscriptions`,
-        { module: "SubscriptionManager" }
-      );
-    }
-  }
-  /**
-   * Notifies all subscribed clients that a resource has changed.
-   */
-  async notifyResourceUpdated(uri) {
-    const sessions = this.subscriptions.get(uri);
-    if (!sessions || sessions.size === 0) {
-      return;
-    }
-    const promises = [];
-    for (const sessionId of sessions) {
-      const server = this.servers.get(sessionId);
-      if (server) {
-        promises.push(
-          server.server.sendResourceUpdated({ uri }).catch((error) => {
-            logger.error(`Failed to notify session ${sessionId} for ${uri}`, {
-              module: "SubscriptionManager",
-              error: error instanceof Error ? error : new Error(String(error))
-            });
-          })
-        );
-      }
-    }
-    await Promise.allSettled(promises);
-  }
-  /**
-   * Broadcasts a generic notification to all connected clients.
-   */
-  async broadcastNotification(method) {
-    if (this.servers.size === 0) {
-      return;
-    }
-    const promises = [];
-    for (const [sessionId, server] of this.servers.entries()) {
-      promises.push(
-        server.server.notification({ method }).catch((error) => {
-          logger.debug(`Failed to broadcast ${method} to session ${sessionId}`, {
-            module: "SubscriptionManager",
-            error: error instanceof Error ? error.message : String(error)
-          });
-        })
-      );
-    }
-    await Promise.allSettled(promises);
-  }
-  /**
-   * Check if there are any active subscribers for a specific URI.
-   */
-  hasSubscribers(uri) {
-    const sessions = this.subscriptions.get(uri);
-    return sessions ? sessions.size > 0 : false;
-  }
-};
-var globalSubscriptionManager = new SubscriptionManager();
-
 // src/transports/http/types.ts
 var HTTP_REQUEST_TIMEOUT_MS = 12e4;
 var HTTP_KEEP_ALIVE_TIMEOUT_MS = 65e3;
@@ -159,6 +28,8 @@ var DEFAULT_RATE_LIMIT_MAX_REQUESTS = 100;
 var DEFAULT_MAX_BODY_BYTES = 1048576;
 var DEFAULT_HSTS_MAX_AGE = 31536e3;
 var CORS_PREFLIGHT_MAX_AGE_SECONDS = 86400;
+var SESSION_TIMEOUT_MS = 30 * 60 * 1e3;
+var SESSION_SWEEP_INTERVAL_MS = 1 * 60 * 1e3;
 function getClientIp(req) {
   return req.ip ?? req.socket.remoteAddress ?? "unknown";
 }
@@ -167,7 +38,7 @@ function checkRateLimit(req, config, rateLimitMap) {
     return { allowed: true };
   }
   const authReq = req;
-  const subject = authReq.auth?.sub ?? authReq.auth?.subject;
+  const subject = authReq.tokenClaims?.sub ?? authReq.tokenClaims?.client_id ?? authReq.auth?.sub ?? authReq.auth?.subject ?? authReq.auth?.clientId;
   const ip = getClientIp(req);
   const rawIdentity = typeof subject === "string" && subject ? subject : ip;
   const clientIdentity = createHash("sha256").update(rawIdentity).digest("hex");
@@ -584,6 +455,7 @@ var TokenValidator = class {
         issuer: this.issuer,
         audience: this.audience,
         clockTolerance: this.clockTolerance,
+        algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"],
         // jose only checks `exp` when it is present. Require it so a validly signed token
         // without an expiry cannot become a permanent credential.
         requiredClaims: ["exp"]
@@ -806,23 +678,19 @@ function createTokenValidator(config) {
   return new TokenValidator(config);
 }
 
-// src/auth/middleware.ts
+// src/auth/transport-agnostic.ts
 function extractBearerToken(authHeader) {
-  if (!authHeader) {
-    return null;
-  }
+  if (!authHeader) return null;
   const parts = authHeader.split(" ");
   const scheme = parts[0];
   const tokenPart = parts[1];
-  if (parts.length !== 2 || scheme?.toLowerCase() !== "bearer") {
-    return null;
-  }
-  if (tokenPart === void 0) {
-    return null;
-  }
+  if (parts.length !== 2 || scheme?.toLowerCase() !== "bearer") return null;
+  if (tokenPart === void 0) return null;
   const token = tokenPart.trim();
   return token.length > 0 ? token : null;
 }
+
+// src/auth/middleware.ts
 function isPublicPath(path2, publicPaths) {
   if (path2 === "/.well-known/oauth-authorization-server" || path2 === "/.well-known/jwks.json") {
     return true;
@@ -959,6 +827,10 @@ data: ${JSON.stringify(message)}
    * Handles the initial GET request to establish the SSE stream.
    */
   handleSseRequest(req, res) {
+    if (this.res !== null) {
+      res.status(409).json({ error: { message: "SSE stream already connected for this session" } });
+      return;
+    }
     this.res = res;
     res.writeHead(200, {
       "Content-Type": "text/event-stream",
@@ -994,15 +866,223 @@ data: ${endpointUrl}
   }
 };
 
-// src/transports/http/server/index.ts
+// src/transports/http/server/protocol-handlers.ts
+var MAX_ACTIVE_SESSIONS = 100;
+function resolveRequestSubject() {
+  const claims = getAuthContext()?.claims;
+  const sub = claims?.sub ?? claims?.email ?? claims?.client_id ?? claims?.subject ?? claims?.clientId;
+  return typeof sub === "string" && sub.length > 0 ? sub : void 0;
+}
+function registerMcpProtocolRoutes(app, config, serverFactory, activeServers, sseTransports) {
+  const statelessMcpHandler = toNodeHandler(
+    createMcpHandler(
+      () => {
+        const server = serverFactory();
+        activeServers.add(server);
+        const originalClose = server.close.bind(server);
+        server.close = async () => {
+          activeServers.delete(server);
+          return originalClose();
+        };
+        return server;
+      },
+      { legacy: "reject" }
+    )
+  );
+  const sessionOwners = /* @__PURE__ */ new Map();
+  const sessionLastActivity = /* @__PURE__ */ new Map();
+  const sweepTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [sid, lastActive] of sessionLastActivity.entries()) {
+      if (now - lastActive > SESSION_TIMEOUT_MS) {
+        const transport = sseTransports.get(sid);
+        if (transport !== void 0) {
+          void transport.close();
+          sseTransports.delete(sid);
+        }
+        sessionOwners.delete(sid);
+        sessionLastActivity.delete(sid);
+        globalSubscriptionManager.unregisterServer(sid);
+      }
+    }
+  }, SESSION_SWEEP_INTERVAL_MS);
+  sweepTimer.unref();
+  const verifySessionOwner = (res, sid) => {
+    const expectedOwner = sessionOwners.get(sid);
+    const callerSubject = resolveRequestSubject();
+    if (expectedOwner !== void 0 && expectedOwner !== callerSubject) {
+      res.status(403).json({ error: { message: "Forbidden: Session belongs to another principal" } });
+      return false;
+    }
+    sessionLastActivity.set(sid, Date.now());
+    return true;
+  };
+  const createSessionAndHandle = (req, res, next, _sid, isLegacySse = false) => {
+    if (sseTransports.size >= MAX_ACTIVE_SESSIONS) {
+      res.status(503).json({
+        error: { message: "Service Unavailable: Maximum active stateful sessions reached" }
+      });
+      return;
+    }
+    const sid = _sid ?? randomUUID();
+    const transport = isLegacySse ? new LegacySSEServerTransport("/messages", sid) : new NodeStreamableHTTPServerTransport({
+      sessionIdGenerator: () => sid
+    });
+    const sessionId = sid;
+    const server = serverFactory();
+    const callerSubject = resolveRequestSubject();
+    if (callerSubject !== void 0) {
+      sessionOwners.set(sessionId, callerSubject);
+    }
+    sessionLastActivity.set(sessionId, Date.now());
+    const authLog = callerSubject !== void 0 ? ` as ${callerSubject}` : "";
+    logger.info(`New MCP stateful session initialized${authLog}`, {
+      module: "HTTP",
+      sessionId,
+      ...callerSubject !== void 0 ? { subject: callerSubject } : {}
+    });
+    activeServers.add(server);
+    globalSubscriptionManager.registerServer(sessionId, server);
+    const originalClose = server.close.bind(server);
+    server.close = async () => {
+      activeServers.delete(server);
+      sseTransports.delete(sessionId);
+      sessionOwners.delete(sessionId);
+      sessionLastActivity.delete(sessionId);
+      globalSubscriptionManager.unregisterServer(sessionId);
+      return originalClose();
+    };
+    sseTransports.set(sessionId, transport);
+    transport.onclose = () => {
+      server.close().catch(
+        (err) => logger.error("Error closing server on transport close", {
+          error: String(err)
+        })
+      );
+    };
+    server.connect(transport).catch(
+      (err) => logger.error("Error connecting server to transport", {
+        error: String(err)
+      })
+    );
+    if (transport instanceof LegacySSEServerTransport) {
+      transport.handleSseRequest(req, res);
+    } else {
+      transport.handleRequest(req, res, req.body).catch((err) => {
+        logger.error("Error handling transport request", {
+          error: String(err),
+          ...err instanceof Error && err.stack !== void 0 ? { stack: err.stack } : {}
+        });
+        next(err);
+      });
+    }
+  };
+  const handleStatefulGet = (req, res, next) => {
+    if (config.stateless) {
+      if (req.path === "/sse" || req.path === "/sse/") {
+        next();
+        return;
+      }
+      res.status(405).json({
+        error: { message: "SSE streaming not available in stateless mode" }
+      });
+      return;
+    }
+    const sid = req.query?.["sessionId"] ?? req.headers?.["mcp-session-id"];
+    if (sid !== void 0 && sid !== "") {
+      const transport = sseTransports.get(sid);
+      if (transport === void 0) {
+        res.status(400).json({ error: { message: "Session not found" } });
+        return;
+      }
+      if (!verifySessionOwner(res, sid)) return;
+      if (transport instanceof LegacySSEServerTransport) {
+        transport.handleSseRequest(req, res);
+      } else {
+        transport.handleRequest(req, res).catch((err) => {
+          next(err);
+        });
+      }
+    } else {
+      if (req.path === "/sse" || req.path === "/sse/") {
+        createSessionAndHandle(req, res, next, randomUUID(), true);
+        return;
+      }
+      res.status(405).json({
+        error: "Method Not Allowed (Streamable HTTP requires POST initialization)"
+      });
+      return;
+    }
+  };
+  app.get("/mcp", handleStatefulGet);
+  app.get("/sse", handleStatefulGet);
+  const handlePost = (req, res, next) => {
+    const sid = req.query?.["sessionId"] ?? req.headers?.["mcp-session-id"];
+    if (sid !== void 0 && sid !== "") {
+      const transport = sseTransports.get(sid);
+      if (transport === void 0) {
+        res.status(400).json({ error: { message: "Session not found" } });
+        return;
+      }
+      if (!verifySessionOwner(res, sid)) return;
+      if (transport instanceof LegacySSEServerTransport) {
+        transport.handlePostMessage(req, res);
+      } else {
+        transport.handleRequest(req, res, req.body).catch((err) => {
+          next(err);
+        });
+      }
+    } else {
+      const acceptsSse = req.headers.accept?.includes("text/event-stream") ?? false;
+      const isLegacyMessages = req.path === "/messages" || req.path === "/messages/";
+      if (isLegacyMessages) {
+        res.status(400).json({ error: { message: "Missing sessionId parameter" } });
+      } else if (acceptsSse && !config.stateless) {
+        createSessionAndHandle(req, res, next, randomUUID(), false);
+      } else {
+        logger.debug("Routing to statelessMcpHandler", {
+          method: req.method,
+          path: req.path
+        });
+        statelessMcpHandler(req, res, req.body).catch((err) => {
+          next(err);
+        });
+      }
+    }
+  };
+  app.post("/mcp", handlePost);
+  app.post("/sse", handlePost);
+  app.post("/messages", handlePost);
+  app.delete("/mcp", (req, res) => {
+    if (config.stateless) {
+      res.status(204).end();
+      return;
+    }
+    const sid = req.query?.["sessionId"] ?? req.headers?.["mcp-session-id"];
+    if (sid === void 0 || sid === "") {
+      res.status(400).json({ error: { message: "Missing sessionId parameter" } });
+      return;
+    }
+    const transport = sseTransports.get(sid);
+    if (transport !== void 0) {
+      if (!verifySessionOwner(res, sid)) return;
+      void transport.close();
+      sseTransports.delete(sid);
+      sessionOwners.delete(sid);
+      sessionLastActivity.delete(sid);
+      globalSubscriptionManager.unregisterServer(sid);
+    }
+    res.status(204).end();
+  });
+}
+
+// src/transports/http/server/http-transport.ts
 var HttpTransport = class {
   app;
   config;
   activeServers = /* @__PURE__ */ new Set();
   httpServer = null;
-  // Map to keep track of stateful SSE transports
   sseTransports = /* @__PURE__ */ new Map();
-  // Rate limiting state
   rateLimitMap = /* @__PURE__ */ new Map();
   rateLimitCleanupTimer = null;
   constructor(config) {
@@ -1011,13 +1091,10 @@ var HttpTransport = class {
       enableRateLimit: config.enableRateLimit ?? true
     };
     this.app = express();
-    if (this.config.trustProxy) {
+    if (this.config.trustProxy === true) {
       this.app.set("trust proxy", "loopback");
     }
   }
-  /**
-   * Initialize and start the HTTP transport
-   */
   async start(serverFactory, scheduler, runtime) {
     const { port, host, authToken, corsOrigins } = this.config;
     const isLocalhost = host === "localhost" || host === "127.0.0.1" || host === "::1";
@@ -1077,23 +1154,19 @@ var HttpTransport = class {
     const maxBody = this.config.maxBodySize ?? DEFAULT_MAX_BODY_BYTES;
     const jsonParser = express.json({ limit: maxBody });
     this.app.use((req, res, next) => {
-      if (req.method === "POST" && req.path === "/mcp" && req.query["sessionId"] === void 0) {
-        const contentLength = parseInt(req.headers["content-length"] || "0", 10);
-        if (contentLength > maxBody) {
-          res.status(413).json({
-            jsonrpc: "2.0",
-            error: {
-              code: -32e3,
-              message: "Payload Too Large: Maximum request body size exceeded"
-            },
-            id: null
-          });
-          return;
-        }
-        next();
-      } else {
-        jsonParser(req, res, next);
+      const contentLength = parseInt(req.headers["content-length"] ?? "0", 10);
+      if (contentLength > maxBody) {
+        res.status(413).json({
+          jsonrpc: "2.0",
+          error: {
+            code: -32e3,
+            message: "Payload Too Large: Maximum request body size exceeded"
+          },
+          id: null
+        });
+        return;
       }
+      jsonParser(req, res, next);
     });
     this.app.use((err, _req, res, next) => {
       if (err !== null && typeof err === "object" && "type" in err) {
@@ -1150,18 +1223,13 @@ var HttpTransport = class {
         }
       }, 6e4);
       this.rateLimitCleanupTimer.unref();
-      logger.info("Rate limiting enabled (using IP)", {
-        module: "HTTP"
-      });
+      logger.info("Rate limiting enabled (using IP)", { module: "HTTP" });
     }
-    if (this.config.oauthEnabled && this.config.oauthIssuer && this.config.oauthAudience) {
+    if (this.config.oauthEnabled === true && this.config.oauthIssuer !== void 0 && this.config.oauthAudience !== void 0) {
       if (this.config.oauthIssuer.startsWith("http://")) {
-        if (!this.config.allowPlaintextLoopbackOAuth) {
+        if (this.config.allowPlaintextLoopbackOAuth !== true) {
           const errorMsg = `FATAL: OAuth issuer targets a plaintext protocol. You MUST deliberately set 'allowPlaintextLoopbackOAuth: true' in config to bypass strict discovery bound.`;
-          logger.error(errorMsg, {
-            module: "HTTP",
-            operation: "oauth-config"
-          });
+          logger.error(errorMsg, { module: "HTTP", operation: "oauth-config" });
           throw new Error(errorMsg);
         }
         try {
@@ -1171,14 +1239,11 @@ var HttpTransport = class {
           }
         } catch {
           const errorMsg = `FATAL: Plaintext OAuth bypass is ONLY permitted for loopback hosts (localhost, 127.0.0.1, [::1]). The configured issuer is not allowed.`;
-          logger.error(errorMsg, {
-            module: "HTTP",
-            operation: "oauth-config"
-          });
+          logger.error(errorMsg, { module: "HTTP", operation: "oauth-config" });
           throw new Error(errorMsg);
         }
       }
-      if (!isLocalhost && !this.config.publicOrigin) {
+      if (!isLocalhost && (this.config.publicOrigin === void 0 || this.config.publicOrigin === "")) {
         const errorMsg = `FATAL: OAuth is enabled on a non-loopback interface ('${host}'), but no 'publicOrigin' was provided. You MUST specify an explicit public origin (e.g. 'https://api.example.com') for secure OAuth token audience binding.`;
         logger.error(errorMsg, { module: "HTTP" });
         throw new Error(errorMsg);
@@ -1210,14 +1275,29 @@ var HttpTransport = class {
         resource: resourceServer.getResourceUri(),
         audience: this.config.oauthAudience
       });
-    } else if (authToken) {
+    } else if (authToken !== void 0 && authToken !== "") {
       this.app.use(createAuthMiddleware(authToken));
     }
     const propagateContextMiddleware = (req, _res, next) => {
       const reqRecord = req;
-      const d = reqRecord[["a", "u", "t", "h"].join("")];
-      if (d !== void 0 && d !== null) {
-        runWithAuthContext({ authenticated: true, claims: d, scopes: d.scopes }, next);
+      const tokenClaims = reqRecord["tokenClaims"];
+      const authInfo = reqRecord["auth"];
+      if (tokenClaims !== void 0 && tokenClaims !== null) {
+        runWithAuthContext(
+          { authenticated: true, claims: tokenClaims, scopes: tokenClaims.scopes },
+          next
+        );
+      } else if (authInfo !== void 0 && authInfo !== null) {
+        const sub = authInfo.sub ?? (typeof authInfo["subject"] === "string" ? authInfo["subject"] : void 0) ?? authInfo.clientId ?? "unknown";
+        const normalizedClaims = {
+          ...authInfo,
+          sub,
+          scopes: Array.isArray(authInfo.scopes) ? authInfo.scopes : []
+        };
+        runWithAuthContext(
+          { authenticated: true, claims: normalizedClaims, scopes: normalizedClaims.scopes },
+          next
+        );
       } else {
         next();
       }
@@ -1229,153 +1309,22 @@ var HttpTransport = class {
       logger.info("Prometheus metrics export enabled on /metrics", { module: "HTTP" });
     }
     this.app.get("/", handleRootInfo);
-    const statelessMcpHandler = toNodeHandler(createMcpHandler(() => {
-      const server = serverFactory();
-      this.activeServers.add(server);
-      const originalClose = server.close.bind(server);
-      server.close = async () => {
-        this.activeServers.delete(server);
-        return originalClose();
-      };
-      return server;
-    }, { legacy: "reject" }));
-    const createSessionAndHandle = (req, res, next, _sid, isLegacySse = false) => {
-      const sid = _sid ?? randomUUID();
-      const transport = isLegacySse ? new LegacySSEServerTransport("/messages", sid) : new NodeStreamableHTTPServerTransport({
-        sessionIdGenerator: () => sid
-      });
-      const sessionId = sid;
-      const server = serverFactory();
-      const authObj = req.auth;
-      const rawSubject = authObj ? authObj["subject"] ?? authObj["clientId"] ?? authObj["client_id"] ?? "unknown" : "";
-      const authSubject = typeof rawSubject === "string" || typeof rawSubject === "number" ? String(rawSubject) : "unknown";
-      const authLog = authObj ? ` as ${authSubject}` : "";
-      logger.info(`New MCP stateful session initialized${authLog}`, {
-        module: "HTTP",
-        sessionId,
-        ...req.auth && { auth: req.auth }
-      });
-      this.activeServers.add(server);
-      globalSubscriptionManager.registerServer(sessionId, server);
-      const originalClose = server.close.bind(server);
-      server.close = async () => {
-        this.activeServers.delete(server);
-        this.sseTransports.delete(sessionId);
-        globalSubscriptionManager.unregisterServer(sessionId);
-        return originalClose();
-      };
-      this.sseTransports.set(sessionId, transport);
-      transport.onclose = () => {
-        server.close().catch((err) => logger.error("Error closing server on transport close", { error: String(err) }));
-      };
-      server.connect(transport).catch((err) => logger.error("Error connecting server to transport", { error: String(err) }));
-      if (transport instanceof LegacySSEServerTransport) {
-        transport.handleSseRequest(req, res);
-      } else {
-        transport.handleRequest(req, res, req.body).catch((err) => {
-          logger.error("Error handling transport request", {
-            error: String(err),
-            stack: err instanceof Error ? err.stack : void 0
-          });
-          next(err);
-        });
-      }
-    };
-    const handleStatefulGet = (req, res, next) => {
-      if (this.config.stateless) {
-        if (req.path === "/sse" || req.path === "/sse/") {
-          next();
-          return;
-        }
-        res.status(405).json({ error: { message: "SSE streaming not available in stateless mode" } });
-        return;
-      }
-      const sid = req.query?.["sessionId"] ?? req.headers?.["mcp-session-id"];
-      if (sid !== void 0 && sid !== "") {
-        const transport = this.sseTransports.get(sid);
-        if (!transport) {
-          res.status(400).json({ error: { message: "Session not found" } });
-          return;
-        }
-        if (transport instanceof LegacySSEServerTransport) {
-          transport.handleSseRequest(req, res);
-        } else {
-          transport.handleRequest(req, res).catch((err) => {
-            next(err);
-          });
-        }
-      } else {
-        if (this.config.stateless) {
-          res.status(405).json({ error: "Method Not Allowed (Stateful SSE is disabled in stateless mode)" });
-          return;
-        }
-        if (req.path === "/sse" || req.path === "/sse/") {
-          createSessionAndHandle(req, res, next, randomUUID(), true);
-          return;
-        }
-        res.status(405).json({ error: "Method Not Allowed (Streamable HTTP requires POST initialization)" });
-        return;
-      }
-    };
-    this.app.get("/mcp", handleStatefulGet);
-    this.app.get("/sse", handleStatefulGet);
-    const handlePost = (req, res, next) => {
-      const sid = req.query?.["sessionId"] ?? req.headers?.["mcp-session-id"];
-      if (sid !== void 0 && sid !== "") {
-        const transport = this.sseTransports.get(sid);
-        if (!transport) {
-          res.status(400).json({ error: { message: "Session not found" } });
-          return;
-        }
-        if (transport instanceof LegacySSEServerTransport) {
-          transport.handlePostMessage(req, res);
-        } else {
-          transport.handleRequest(req, res, req.body).catch((err) => {
-            next(err);
-          });
-        }
-      } else {
-        const acceptsSse = req.headers.accept?.includes("text/event-stream") ?? false;
-        const isLegacyMessages = req.path === "/messages" || req.path === "/messages/";
-        if (isLegacyMessages) {
-          res.status(400).json({ error: { message: "Missing sessionId parameter" } });
-        } else if (acceptsSse && !this.config.stateless) {
-          createSessionAndHandle(req, res, next, randomUUID(), false);
-        } else {
-          logger.info("Routing to statelessMcpHandler", { method: req.method, path: req.path, headers: req.headers, body: req.body });
-          statelessMcpHandler(req, res, req.body).catch((err) => {
-            next(err);
-          });
-        }
-      }
-    };
-    this.app.post("/mcp", handlePost);
-    this.app.post("/sse", handlePost);
-    this.app.post("/messages", handlePost);
-    this.app.delete("/mcp", (req, res) => {
-      if (this.config.stateless) {
-        res.status(204).end();
-        return;
-      }
-      const sid = req.query?.["sessionId"] ?? req.headers?.["mcp-session-id"];
-      if (!sid) {
-        res.status(400).json({ error: { message: "Missing sessionId parameter" } });
-        return;
-      }
-      const transport = this.sseTransports.get(sid);
-      if (transport) {
-        void transport.close();
-        this.sseTransports.delete(sid);
-        globalSubscriptionManager.unregisterServer(sid);
-      }
-      res.status(204).end();
-    });
+    registerMcpProtocolRoutes(
+      this.app,
+      this.config,
+      serverFactory,
+      this.activeServers,
+      this.sseTransports
+    );
     this.app.use((req, res) => {
-      logger.debug("404 Not Found", { method: req.method, path: req.path, query: req.query, headers: req.headers });
+      logger.debug("404 Not Found", {
+        method: req.method,
+        path: req.path
+      });
       res.status(404).json({ error: "Not found" });
     });
     this.httpServer = this.app.listen(port, host, () => {
-      if (this.httpServer) {
+      if (this.httpServer !== null) {
         this.httpServer.setTimeout(HTTP_REQUEST_TIMEOUT_MS);
         this.httpServer.keepAliveTimeout = HTTP_KEEP_ALIVE_TIMEOUT_MS;
         this.httpServer.headersTimeout = HTTP_HEADERS_TIMEOUT_MS;
@@ -1395,13 +1344,10 @@ var HttpTransport = class {
       logger.info("HTTP server closed", { module: "HTTP" });
     });
   }
-  /**
-   * Graceful shutdown
-   */
   async stop(scheduler) {
     logger.info("Shutting down HTTP server...", { module: "HTTP" });
     scheduler?.stop();
-    if (this.rateLimitCleanupTimer) {
+    if (this.rateLimitCleanupTimer !== null) {
       clearInterval(this.rateLimitCleanupTimer);
       this.rateLimitCleanupTimer = null;
     }
@@ -1487,7 +1433,8 @@ async function rebuildIndex(manager, dbAdapter, progress, options) {
           }
         }
         try {
-          const text = `[${entry.entryType}] ${entry.content}`;
+          const tagsText = entry.tags !== void 0 && entry.tags !== null && entry.tags.length > 0 ? ` [Tags: ${entry.tags.join(", ")}]` : "";
+          const text = `[${entry.entryType}]${tagsText} ${entry.content}`;
           const embedding = await manager.generateEmbedding(text);
           vectorsToUpsert.push({ entryId: entry.id, embedding });
         } catch (err) {
@@ -1539,7 +1486,7 @@ async function rebuildIndex(manager, dbAdapter, progress, options) {
 }
 
 // src/vector/vector-search-manager/manager.ts
-var VectorSearchManager = class {
+var VectorSearchManager = class _VectorSearchManager {
   dbAdapter;
   modelName;
   dimensions = null;
@@ -1567,7 +1514,7 @@ var VectorSearchManager = class {
    * Check if the vector search manager is initialized
    */
   isInitialized() {
-    return this.initializationPromise !== null && this.pipeline !== null;
+    return this.initializationPromise !== null && (this.pipeline !== null || this.dimensions !== null);
   }
   /**
    * Initialize the vector search manager.
@@ -1580,29 +1527,45 @@ var VectorSearchManager = class {
     if (this.initializationPromise) {
       return this.initializationPromise;
     }
-    this.initializationPromise = this._initialize();
+    this.initializationPromise = this._initialize().catch((error) => {
+      this.initializationPromise = null;
+      throw error;
+    });
     return this.initializationPromise;
   }
   async _initialize() {
     try {
       logger.info("Initializing vector search...");
-      if (this.transformers === null) {
-        const transformersModule2 = await import('@huggingface/transformers');
-        this.transformers = transformersModule2;
-        transformersModule2.env.allowRemoteModels = true;
-        transformersModule2.env.localModelPath = ".cache/huggingface";
+      const hasCustomEmbeddingFn = this.generateEmbedding !== _VectorSearchManager.prototype.generateEmbedding;
+      if (hasCustomEmbeddingFn) {
+        logger.info("Detecting embedding dimensions via custom embedding generator...");
+        const testEmbedding = await this.generateEmbedding("test");
+        this.dimensions = testEmbedding.length;
+        this.pipeline = true;
+        logger.info(`Detected ${this.dimensions} dimensions for ${this.modelName}`);
+      } else {
+        if (this.transformers === null) {
+          const transformersModule2 = await import('@huggingface/transformers');
+          this.transformers = transformersModule2;
+          transformersModule2.env.allowRemoteModels = true;
+          transformersModule2.env.localModelPath = ".cache/huggingface";
+        }
+        logger.info(`Loading embedding model: ${this.modelName}`);
+        const transformersModule = this.transformers;
+        this.pipeline = await transformersModule.pipeline(
+          "feature-extraction",
+          this.modelName,
+          {
+            dtype: "fp32"
+          }
+        );
+        logger.info("Embedding model loaded");
+        logger.info("Detecting embedding dimensions...");
+        const pipelineFunc = this.pipeline;
+        const testResult = await pipelineFunc("test", { pooling: "mean", normalize: true });
+        this.dimensions = testResult.data.length;
+        logger.info(`Detected ${this.dimensions} dimensions for ${this.modelName}`);
       }
-      logger.info(`Loading embedding model: ${this.modelName}`);
-      const transformersModule = this.transformers;
-      this.pipeline = await transformersModule.pipeline("feature-extraction", this.modelName, {
-        dtype: "fp32"
-      });
-      logger.info("Embedding model loaded");
-      logger.info("Detecting embedding dimensions...");
-      const pipelineFunc = this.pipeline;
-      const testResult = await pipelineFunc("test", { pooling: "mean", normalize: true });
-      this.dimensions = testResult.data.length;
-      logger.info(`Detected ${this.dimensions} dimensions for ${this.modelName}`);
       this.verifyAndCreateVecTable();
       logger.info("Vector search initialized successfully");
     } catch (error) {
@@ -1699,25 +1662,38 @@ var VectorSearchManager = class {
   /**
    * Search for similar entries by text query
    */
-  async search(query, limit = 10, threshold = 0) {
+  async search(query, limit = 10, threshold = 0, workspaceId) {
     await this.initialize();
     try {
       const queryEmbedding = await this.generateEmbedding(query);
       const results = this.dbAdapter.searchVectors(queryEmbedding, limit);
-      const searchResults = [];
+      const candidates = [];
       for (const result of results) {
-        const entry = this.dbAdapter.getEntryById(result.entry_id);
-        if (entry) {
-          const similarityScore = Math.max(-1, 1 - result.distance * result.distance / 2);
-          if (similarityScore >= threshold) {
-            searchResults.push({
-              entryId: result.entry_id,
-              entry,
-              distance: result.distance,
-              score: similarityScore,
-              similarityScore
-            });
-          }
+        const similarityScore = Math.max(-1, 1 - result.distance * result.distance / 2);
+        if (similarityScore >= threshold) {
+          candidates.push({
+            entryId: result.entry_id,
+            distance: result.distance,
+            similarityScore
+          });
+        }
+      }
+      if (candidates.length === 0) {
+        return [];
+      }
+      const targetWs = workspaceId ?? "*";
+      const entriesMap = typeof this.dbAdapter.getEntriesByIds === "function" ? this.dbAdapter.getEntriesByIds(candidates.map((c) => c.entryId)) : null;
+      const searchResults = [];
+      for (const candidate of candidates) {
+        const entry = entriesMap ? entriesMap.get(candidate.entryId) ?? null : this.dbAdapter.getEntryById(candidate.entryId, targetWs);
+        if (entry && (targetWs === "*" || entry.workspaceId === void 0 || entry.workspaceId === targetWs)) {
+          searchResults.push({
+            entryId: candidate.entryId,
+            entry,
+            distance: candidate.distance,
+            score: candidate.similarityScore,
+            similarityScore: candidate.similarityScore
+          });
         }
         if (searchResults.length >= limit) break;
       }
@@ -1733,36 +1709,50 @@ var VectorSearchManager = class {
   /**
    * Search for similar entries using an existing entry as the query
    */
-  async searchByEntryId(entryId, limit = 10, threshold = 0) {
+  async searchByEntryId(entryId, limit = 10, threshold = 0, workspaceId) {
     await this.initialize();
     try {
+      const sourceEntry = this.dbAdapter.getEntryById(entryId, workspaceId ?? "*");
+      if (!sourceEntry) {
+        throw new Error(`Entry ${entryId} not found`);
+      }
       let queryEmbedding = this.dbAdapter.getVector(entryId);
       if (!queryEmbedding) {
-        const entry = this.dbAdapter.getEntryById(entryId);
-        if (!entry) {
-          throw new Error(`Entry ${entryId} not found`);
-        }
-        const tagsText = entry.tags !== void 0 && entry.tags !== null && entry.tags.length > 0 ? ` [Tags: ${entry.tags.join(", ")}]` : "";
-        const text = `[${entry.entryType}]${tagsText} ${entry.content}`;
+        const tagsText = sourceEntry.tags !== void 0 && sourceEntry.tags !== null && sourceEntry.tags.length > 0 ? ` [Tags: ${sourceEntry.tags.join(", ")}]` : "";
+        const text = `[${sourceEntry.entryType}]${tagsText} ${sourceEntry.content}`;
         queryEmbedding = await this.generateEmbedding(text);
         this.dbAdapter.upsertVector(entryId, queryEmbedding);
       }
       const results = this.dbAdapter.searchVectors(queryEmbedding, limit + 1);
-      const searchResults = [];
+      const candidates = [];
       for (const result of results) {
-        if (result.entry_id === entryId) continue;
-        const entry = this.dbAdapter.getEntryById(result.entry_id);
-        if (entry) {
-          const similarityScore = Math.max(-1, 1 - result.distance * result.distance / 2);
-          if (similarityScore >= threshold) {
-            searchResults.push({
-              entryId: result.entry_id,
-              entry,
-              distance: result.distance,
-              score: similarityScore,
-              similarityScore
-            });
-          }
+        const candidateId = result.entry_id;
+        if (candidateId === entryId) continue;
+        const similarityScore = Math.max(-1, 1 - result.distance * result.distance / 2);
+        if (similarityScore >= threshold) {
+          candidates.push({
+            entryId: candidateId,
+            distance: result.distance,
+            similarityScore
+          });
+        }
+      }
+      if (candidates.length === 0) {
+        return [];
+      }
+      const targetWs = workspaceId ?? "*";
+      const entriesMap = typeof this.dbAdapter.getEntriesByIds === "function" ? this.dbAdapter.getEntriesByIds(candidates.map((c) => c.entryId)) : null;
+      const searchResults = [];
+      for (const candidate of candidates) {
+        const entry = entriesMap ? entriesMap.get(candidate.entryId) ?? null : this.dbAdapter.getEntryById(candidate.entryId, targetWs);
+        if (entry && (targetWs === "*" || entry.workspaceId === void 0 || entry.workspaceId === targetWs)) {
+          searchResults.push({
+            entryId: candidate.entryId,
+            entry,
+            distance: candidate.distance,
+            score: candidate.similarityScore,
+            similarityScore: candidate.similarityScore
+          });
         }
         if (searchResults.length >= limit) break;
       }
@@ -1815,8 +1805,44 @@ var VectorSearchManagerProxy = {
     });
   }
 };
-
-// src/server/digest-reporter.ts
+function isBlockedWebhookIp(ip) {
+  const normalized = ip.toLowerCase();
+  if (normalized === "localhost" || normalized === "::1" || normalized === "0.0.0.0" || normalized === "::" || normalized.startsWith("127.") || normalized.startsWith("10.") || normalized.startsWith("192.168.") || normalized.startsWith("169.254.") || normalized.startsWith("fe80:") || normalized.startsWith("fc00:") || normalized.startsWith("fd00:") || normalized.startsWith("::ffff:")) {
+    return true;
+  }
+  const octets = normalized.split(".");
+  if (octets.length === 4 && octets[0] === "172") {
+    const second = Number(octets[1]);
+    if (second >= 16 && second <= 31) {
+      return true;
+    }
+  }
+  return false;
+}
+async function validateWebhookUrl(webhookUrl) {
+  let parsed;
+  try {
+    parsed = new URL(webhookUrl);
+  } catch {
+    throw new Error("Invalid webhook URL format");
+  }
+  const allowInsecureHttp = process.env["ALLOW_INSECURE_WEBHOOK_HTTP"] === "true";
+  if (parsed.protocol !== "https:" && !(allowInsecureHttp && parsed.protocol === "http:")) {
+    throw new Error(`Disallowed webhook protocol: ${parsed.protocol} (https: required)`);
+  }
+  const hostname = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local") || hostname.endsWith(".internal") || isBlockedWebhookIp(hostname)) {
+    throw new Error(`Webhook hostname resolves to restricted network address: ${hostname}`);
+  }
+  if (!process.env["VITEST"]) {
+    const records = await dns.promises.lookup(hostname, { all: true });
+    for (const rec of records) {
+      if (isBlockedWebhookIp(rec.address)) {
+        throw new Error(`Webhook DNS resolved to private/loopback IP: ${rec.address}`);
+      }
+    }
+  }
+}
 function formatDigestReport(snapshot, serverVersion) {
   const lines = [];
   lines.push(`# Memory Journal Digest`);
@@ -1853,6 +1879,15 @@ function formatDigestReport(snapshot, serverVersion) {
 }
 async function deliverReport(report, snapshot, options) {
   const { webhookUrl, webhookAuth, contentType = "slack" } = options;
+  try {
+    await validateWebhookUrl(webhookUrl);
+  } catch (err) {
+    logger.error("Refusing to deliver digest report to unsafe webhook URL", {
+      module: "DigestReporter",
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return false;
+  }
   let bodyPayload;
   if (contentType === "discord") {
     bodyPayload = JSON.stringify({ content: report });
@@ -1880,7 +1915,8 @@ async function deliverReport(report, snapshot, options) {
         method: "POST",
         headers,
         body: bodyPayload,
-        signal: controller.signal
+        signal: controller.signal,
+        redirect: "error"
       });
       clearTimeout(timeoutId);
       if (response.ok) {
@@ -1930,6 +1966,7 @@ var Scheduler = class {
   vectorManager;
   timers = [];
   started = false;
+  sigtermHandler = null;
   runtime;
   constructor(options, db, vectorManager, runtime) {
     this.options = options;
@@ -1949,7 +1986,10 @@ var Scheduler = class {
       return;
     }
     this.started = true;
-    process.on("SIGTERM", () => this.stop());
+    this.sigtermHandler = () => {
+      this.stop();
+    };
+    process.on("SIGTERM", this.sigtermHandler);
     const { backupIntervalMinutes, vacuumIntervalMinutes, rebuildIndexIntervalMinutes } = this.options;
     if (backupIntervalMinutes > 0) {
       this.scheduleJob("backup", backupIntervalMinutes, () => this.runBackup());
@@ -2011,6 +2051,10 @@ var Scheduler = class {
         module: "Scheduler"
       });
     }
+    if (this.sigtermHandler !== null) {
+      process.off("SIGTERM", this.sigtermHandler);
+      this.sigtermHandler = null;
+    }
     this.timers.length = 0;
     this.started = false;
   }
@@ -2322,11 +2366,14 @@ var ServerRuntime = class {
 };
 var ConfigManager = class extends EventEmitter {
   config;
+  initialCodemodeFullAccess;
   configFilePath;
   watcher;
+  isWriting = false;
   constructor(initialConfig, configFilePath) {
     super();
     this.config = { ...initialConfig };
+    this.initialCodemodeFullAccess = Boolean(initialConfig.codemodeInternalFullAccess);
     this.configFilePath = configFilePath;
     if (this.configFilePath && fs.existsSync(this.configFilePath)) {
       this.watchFile();
@@ -2350,6 +2397,7 @@ var ConfigManager = class extends EventEmitter {
   }
   persistToFile() {
     if (!this.configFilePath) return;
+    this.isWriting = true;
     try {
       const content = fs.readFileSync(this.configFilePath, "utf-8");
       let parsed = {};
@@ -2383,15 +2431,16 @@ var ConfigManager = class extends EventEmitter {
       }
     } catch (e) {
       logger.error("Failed to persist configuration to file", { module: "ConfigManager", error: e instanceof Error ? e.message : String(e) });
+    } finally {
+      this.isWriting = false;
     }
   }
   watchFile() {
     if (!this.configFilePath) return;
     let debounceTimer;
-    const isWriting = false;
     try {
       this.watcher = fs.watch(this.configFilePath, (eventType) => {
-        if (eventType === "change" && !isWriting) {
+        if (eventType === "change" && !this.isWriting) {
           clearTimeout(debounceTimer);
           debounceTimer = setTimeout(() => {
             try {
@@ -2402,6 +2451,13 @@ var ConfigManager = class extends EventEmitter {
           }, 500);
         }
       });
+      this.watcher.on("error", (err) => {
+        logger.warning("Config file watcher error", {
+          module: "ConfigManager",
+          path: this.configFilePath,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      });
       logger.info("Watching configuration file for changes", { module: "ConfigManager", path: this.configFilePath });
     } catch (error) {
       logger.warning("Failed to start configuration file watcher", { module: "ConfigManager", error: error instanceof Error ? error.message : String(error) });
@@ -2422,7 +2478,10 @@ var ConfigManager = class extends EventEmitter {
         updates.rawToolFilter = typeof parsed["toolFilter"] === "string" ? parsed["toolFilter"] : void 0;
       }
       if ("codemodeInternalFullAccess" in parsed) {
-        updates.codemodeInternalFullAccess = typeof parsed["codemodeInternalFullAccess"] === "boolean" ? parsed["codemodeInternalFullAccess"] : void 0;
+        const requested = typeof parsed["codemodeInternalFullAccess"] === "boolean" ? parsed["codemodeInternalFullAccess"] : void 0;
+        if (requested === false || requested === true && this.initialCodemodeFullAccess) {
+          updates.codemodeInternalFullAccess = requested;
+        }
       }
       const bc = { ...this.config.briefingConfig };
       let bcChanged = false;
@@ -2843,34 +2902,457 @@ function registerPrompts(server, prompts, db, teamDb, runtime, github, briefingC
   }
 }
 
-// src/server/mcp-server/tool-registration.ts
+// src/server/mcp-server/tool-registration/list-interceptor.ts
+function attachListToolsInterceptor(requestHandlers, configManager, allToolNames) {
+  const listToolsHandler = requestHandlers?.get("tools/list");
+  if (listToolsHandler === void 0 || requestHandlers === void 0) {
+    return;
+  }
+  requestHandlers.set("tools/list", async (request2, extra) => {
+    const currentConfig = configManager.getConfig();
+    const enabledSet = currentConfig.toolFilterConfig?.enabledTools ?? allToolNames;
+    const result = await listToolsHandler(request2, extra);
+    const res = result;
+    if (Array.isArray(res?.tools)) {
+      res.tools = res.tools.filter((t) => enabledSet.has(t.name));
+    }
+    return result;
+  });
+}
+
+// src/server/mcp-server/tool-registration/call-interceptor.ts
+var ALIASED_EXECUTE_CODE_NAMES = /* @__PURE__ */ new Set([
+  "mysql_execute_code",
+  "mysqlExecuteCode",
+  "execute_code",
+  "executeCode",
+  "mjExecuteCode",
+  "mj_eval",
+  "eval_code",
+  "run_code",
+  "exec_code",
+  "code_execute"
+]);
+var ALIASED_LIST_PROJECTS_NAMES = /* @__PURE__ */ new Set([
+  "listProjects",
+  "list-projects",
+  "get_projects",
+  "getProjects",
+  "get-projects",
+  "mj_list_projects",
+  "mjListProjects",
+  "mj_get_projects",
+  "mjGetProjects",
+  "mj_admin_list_projects",
+  "mj_admin_get_projects"
+]);
+var ALIASED_GET_PROJECT_NAMES = /* @__PURE__ */ new Set([
+  "getProject",
+  "get-project",
+  "mj_get_project",
+  "mjGetProject",
+  "mj_admin_get_project"
+]);
+var ALIASED_GREP_SEARCH_NAMES = new Set(DUMMY_GREP_SEARCH_TOOL_NAMES);
+var ALIASED_VIEW_FILE_NAMES = new Set(
+  DUMMY_FILE_VIEW_TOOL_NAMES.filter((name) => name !== "cat")
+);
+var ALIASED_LIST_DIR_NAMES = new Set(
+  DUMMY_DIR_LIST_TOOL_NAMES.filter((name) => name !== "ls" && name !== "dir")
+);
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var ALL_KNOWN_GROUP_TOOLS = new Set(Object.values(TOOL_GROUPS).flat());
+var UPPERCASE_RE = /[A-Z]/;
+function deepCamelToSnake(obj, depth = 0) {
+  if (depth > 12) return obj;
+  if (Array.isArray(obj)) return obj.map((item) => deepCamelToSnake(item, depth + 1));
+  if (obj !== null && typeof obj === "object") {
+    const newObj = {};
+    for (const [k, v] of Object.entries(obj)) {
+      if (FORBIDDEN_KEYS.has(k)) continue;
+      const snakeKey = UPPERCASE_RE.test(k) ? k.replace(/^[A-Z]/, (letter) => letter.toLowerCase()).replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`) : k;
+      if (FORBIDDEN_KEYS.has(snakeKey)) continue;
+      newObj[snakeKey] = deepCamelToSnake(v, depth + 1);
+    }
+    return newObj;
+  }
+  return obj;
+}
+function formatSuccessPayload(payload) {
+  const enriched = JSON.stringify(payload, null, 2);
+  return {
+    content: [{ type: "text", text: enriched }],
+    structuredContent: payload
+  };
+}
+function formatTokenEstimatedError(errorResult, isError) {
+  const enriched = JSON.stringify({ ...errorResult, _meta: { tokenEstimate: 0 } });
+  const tokenEstimate = Math.ceil(Buffer.byteLength(enriched, "utf8") / 4);
+  const finalText = enriched.replace('"tokenEstimate":0', `"tokenEstimate":${tokenEstimate}`);
+  return {
+    content: [{ type: "text", text: finalText }],
+    structuredContent: errorResult,
+    ...isError ? { isError: true } : {}
+  };
+}
+function parseZodErrorsFromMessage(rawText, prefixToRemove) {
+  let errorMessage = prefixToRemove !== void 0 ? rawText.replace(prefixToRemove, "") : rawText;
+  try {
+    const parts = rawText.split(": [");
+    if (parts.length > 1) {
+      const zodErrors = JSON.parse("[" + parts[1]);
+      errorMessage = zodErrors.map((e) => `${e.path && e.path.length > 0 ? e.path.join(".") : "unknown"}: ${e.message ?? "invalid"}`).join("; ");
+    }
+  } catch {
+  }
+  return errorMessage;
+}
+function isSuccessObject(res) {
+  return typeof res === "object" && res !== null && res["success"] === true;
+}
+function matchesSuffixes(name, list, suffixes) {
+  return list.includes(name) || suffixes.some((s) => name.endsWith(s));
+}
+async function tryAutonomousUnknownToolFallback(requestedTool, toolArgs, matchingPrompt, context, allTools, allToolNames, customToolHandlerConfig) {
+  const { configManager, db, teamDb, vectorManager, teamVectorManager, github, runtime } = context;
+  const currentConfig = configManager.getConfig();
+  const toolContext = {
+    db,
+    ...teamDb !== void 0 ? { teamDb } : {},
+    vectorManager,
+    ...teamVectorManager !== void 0 ? { teamVectorManager } : {},
+    github,
+    config: {
+      ...customToolHandlerConfig,
+      filterConfig: currentConfig.toolFilterConfig,
+      briefingConfig: currentConfig.briefingConfig,
+      runtime
+    }
+  };
+  if (matchingPrompt !== void 0) {
+    enforceAccessBoundary(matchingPrompt.name, "prompt", void 0, runtime.auditLogger);
+    const res = await handlePrompt(toolArgs, requestedTool, toolContext);
+    if (isSuccessObject(res)) return formatSuccessPayload(res);
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_RESOURCE_TOOL_NAMES, ["_read_resource", "ReadResource"]) || requestedTool === "mjReadResource" || requestedTool.startsWith("memory://")) {
+    enforceAccessBoundary("read_resource", "tool", void 0, runtime.auditLogger);
+    const res = await handleReadResource(toolArgs, requestedTool, toolContext);
+    if (isSuccessObject(res)) return formatSuccessPayload(res);
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_LIST_RESOURCE_TOOL_NAMES, ["_list_resources", "ListResources"])) {
+    enforceAccessBoundary("list_resources", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(handleListResources(requestedTool));
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_LIST_PROMPT_TOOL_NAMES, ["_list_prompts", "ListPrompts"])) {
+    enforceAccessBoundary("list_prompts", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(handleListPrompts(requestedTool));
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_LIST_TOOL_NAMES, ["_list_tools", "ListTools"])) {
+    enforceAccessBoundary("list_tools", "tool", void 0, runtime.auditLogger);
+    const enabledSet = currentConfig.toolFilterConfig?.enabledTools ?? allToolNames;
+    const toolsList = allTools.filter((t) => enabledSet.has(t.name)).map((t) => ({ name: t.name, title: t.title, description: t.description, annotations: t.annotations }));
+    return formatSuccessPayload({
+      success: true,
+      tools: toolsList,
+      _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' was called as an MCP tool instead of an MCP protocol request (tools/list). The available tools were returned successfully.`
+    });
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_GET_PROMPT_TOOL_NAMES, ["_get_prompt", "GetPrompt"])) {
+    enforceAccessBoundary("get_prompt", "tool", void 0, runtime.auditLogger);
+    const res = await handleGetPrompt(toolArgs, requestedTool, toolContext);
+    if (isSuccessObject(res)) return formatSuccessPayload(res);
+  }
+  if (DUMMY_SERVER_INFO_TOOL_NAMES.includes(requestedTool)) {
+    enforceAccessBoundary("server_info", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(await handleServerInfo(toolArgs, requestedTool, toolContext));
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_PROJECT_TOOL_NAMES, ["list_projects", "listProjects", "ListProjects"]) || requestedTool === "projects") {
+    enforceAccessBoundary("list_projects", "tool", void 0, runtime.auditLogger);
+    const cfg = currentConfig;
+    return formatSuccessPayload({
+      success: true,
+      projects: cfg.projectRegistry ?? {},
+      _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' was called as an MCP tool. Returned registered projects from projectRegistry successfully.`
+    });
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_ADAPTER_TOOL_NAMES, ["list_adapters", "listAdapters", "ListAdapters"])) {
+    enforceAccessBoundary("list_adapters", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(handleListAdapters(requestedTool, toolContext));
+  }
+  if (matchesSuffixes(requestedTool, DUMMY_GREP_SEARCH_TOOL_NAMES, ["grep_search", "grepSearch"])) {
+    enforceAccessBoundary("grep_search", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(await handleGrepSearch(toolArgs, requestedTool, toolContext));
+  }
+  if (DUMMY_FILE_VIEW_TOOL_NAMES.includes(requestedTool)) {
+    enforceAccessBoundary("view_file", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(await handleViewFile(toolArgs, requestedTool, toolContext));
+  }
+  if (DUMMY_DIR_LIST_TOOL_NAMES.includes(requestedTool)) {
+    enforceAccessBoundary("list_dir", "tool", void 0, runtime.auditLogger);
+    return formatSuccessPayload(await handleListDir(toolArgs, requestedTool, toolContext));
+  }
+  return void 0;
+}
+function normalizeAndAliasToolCall(reqParams, options) {
+  reqParams.arguments = deepCamelToSnake(reqParams.arguments);
+  const toolArgs = reqParams.arguments;
+  if (toolArgs["project_number"] === void 0) {
+    const repoStr = typeof toolArgs["repo"] === "string" ? toolArgs["repo"] : typeof toolArgs["project"] === "string" ? toolArgs["project"] : void 0;
+    if (repoStr !== void 0 && repoStr !== "") toolArgs["project_number"] = repoStr;
+  }
+  if (typeof toolArgs["project_number"] === "string") {
+    const strVal = toolArgs["project_number"];
+    const parsed = Number(strVal);
+    if (!Number.isNaN(parsed)) {
+      toolArgs["project_number"] = parsed;
+    } else if (options.projectRegistry !== void 0) {
+      let entry = options.projectRegistry[strVal];
+      if (entry === void 0 && strVal.includes("/")) {
+        const repoName = strVal.split("/").pop();
+        if (repoName !== void 0 && repoName !== "") entry = options.projectRegistry[repoName];
+      }
+      if (entry?.project_number !== void 0) toolArgs["project_number"] = entry.project_number;
+    }
+  }
+  const currentName = reqParams.name;
+  if (currentName !== void 0 && currentName !== "") {
+    if (ALIASED_EXECUTE_CODE_NAMES.has(currentName)) {
+      reqParams.name = "mj_execute_code";
+    } else if (currentName === "create_entry_minimal") {
+      reqParams.name = "create_entry";
+      if (toolArgs["entry_type"] === void 0) toolArgs["entry_type"] = "personal_reflection";
+    } else if (ALIASED_LIST_PROJECTS_NAMES.has(currentName)) {
+      reqParams.name = "list_projects";
+    } else if (ALIASED_GET_PROJECT_NAMES.has(currentName)) {
+      reqParams.name = "get_project";
+    } else if (ALIASED_GREP_SEARCH_NAMES.has(currentName)) {
+      reqParams.name = "grep_search";
+    } else if (ALIASED_VIEW_FILE_NAMES.has(currentName)) {
+      reqParams.name = "view_file";
+    } else if (ALIASED_LIST_DIR_NAMES.has(currentName)) {
+      reqParams.name = "list_dir";
+    }
+  }
+}
+function attachCallToolInterceptor(requestHandlers, context, options, prompts, allTools, allToolNames, customToolHandlerConfig) {
+  const originalHandler = requestHandlers?.get("tools/call");
+  if (originalHandler === void 0 || requestHandlers === void 0) return;
+  requestHandlers.set("tools/call", async (request2, extra) => {
+    try {
+      const req = request2;
+      const healingEnabled = options.agentHealing !== false && customToolHandlerConfig.agentHealing !== false;
+      if (req.params?.arguments !== void 0 && healingEnabled) {
+        normalizeAndAliasToolCall(req.params, options);
+        const toolArgs = req.params.arguments;
+        if (req.params.name !== void 0 && req.params.name !== "") {
+          const intercept = applyArgInterceptions(req.params.name, [toolArgs]);
+          if ("error" in intercept) {
+            const errorResult = intercept.error;
+            logAgentIssue({
+              source: "MCP",
+              action: req.params.name,
+              input: toolArgs,
+              error: errorResult["error"] ?? "Validation Error"
+            });
+            return formatTokenEstimatedError(errorResult, false);
+          }
+          const normalizedArgs = intercept.args?.[0];
+          if (normalizedArgs !== null && normalizedArgs !== void 0 && typeof normalizedArgs === "object" && !Array.isArray(normalizedArgs)) {
+            req.params.arguments = normalizedArgs;
+          }
+        }
+      }
+      if (req.params?.name !== void 0 && req.params.name !== "" && !allToolNames.has(req.params.name)) {
+        const requestedTool = req.params.name;
+        const toolArgs = req.params.arguments ?? {};
+        const normalized = requestedTool.replace(/^mj_/, "").replace(/_/g, "-");
+        const matchingPrompt = prompts.find(
+          (p) => p.name === normalized || p.name === requestedTool || p.name === requestedTool.replace(/^mj_/, "")
+        );
+        if (healingEnabled) {
+          const fallbackResponse = await tryAutonomousUnknownToolFallback(
+            requestedTool,
+            toolArgs,
+            matchingPrompt,
+            context,
+            allTools,
+            allToolNames,
+            customToolHandlerConfig
+          );
+          if (fallbackResponse !== void 0) return fallbackResponse;
+        }
+        let suggestion = `Tool '${requestedTool}' does not exist. Use tools/list to see available tools.`;
+        const isFilteredTool = ALL_KNOWN_GROUP_TOOLS.has(requestedTool);
+        if (isFilteredTool) {
+          suggestion = `'${requestedTool}' is a valid tool but it is not currently exposed because of your active --tool-filter or codemode restrictions. If you are in Code Mode, invoke it via 'mj_execute_code' (e.g. 'await mj.core.${requestedTool}(...)').`;
+        } else if (matchingPrompt !== void 0) {
+          suggestion = `'${requestedTool}' is an MCP Prompt, not an MCP Tool. Please use the 'get_prompt' tool (or your native MCP Prompts integration) to evaluate it, then use 'create_entry' to save the result.`;
+        } else if (requestedTool.startsWith("mj_")) {
+          suggestion = `'${requestedTool}' is not a valid root tool. If you are trying to use Code Mode, you must invoke the 'mj_execute_code' tool and write javascript (e.g. 'await mj.core.searchEntries(...)').`;
+        }
+        const errorResult = {
+          success: false,
+          error: `MCP error -32602: Tool ${requestedTool} not found`,
+          code: "TOOL_NOT_FOUND",
+          category: "hallucination",
+          suggestion,
+          recoverable: false
+        };
+        if (healingEnabled) {
+          logAgentIssue({
+            source: "MCP",
+            action: requestedTool,
+            input: toolArgs,
+            error: errorResult.error
+          });
+        }
+        return formatTokenEstimatedError(errorResult, true);
+      }
+      const result = await originalHandler(request2, extra);
+      if (result !== null && result !== void 0 && typeof result === "object" && "isError" in result && result.isError === true) {
+        const resObj = result;
+        if (Array.isArray(resObj.content) && resObj.content.length > 0) {
+          const text = resObj.content[0]?.text;
+          if (typeof text === "string" && text.includes("MCP error -32602")) {
+            const errorMessage = parseZodErrorsFromMessage(
+              text,
+              "MCP error -32602: Input validation error: "
+            );
+            const errorResult = {
+              success: false,
+              error: errorMessage,
+              code: "VALIDATION_ERROR",
+              category: "validation",
+              suggestion: "Check input parameters against the tool schema",
+              recoverable: false
+            };
+            logAgentIssue({
+              source: "MCP",
+              action: req.params?.name ?? "unknown",
+              input: req.params?.arguments ?? {},
+              error: errorMessage
+            });
+            return formatTokenEstimatedError(errorResult, false);
+          }
+        }
+      }
+      return result;
+    } catch (error) {
+      const err = error;
+      if (err.code === -32602) {
+        let errorMessage = err.message ?? "Validation Error";
+        if (typeof errorMessage === "string" && errorMessage.includes("Invalid arguments for tool")) {
+          errorMessage = parseZodErrorsFromMessage(errorMessage);
+        }
+        const errorResult = {
+          success: false,
+          error: errorMessage,
+          code: "VALIDATION_ERROR",
+          category: "validation",
+          suggestion: "Check input parameters against the tool schema",
+          recoverable: false
+        };
+        const fallbackReq = request2;
+        logAgentIssue({
+          source: "MCP",
+          action: fallbackReq.params?.name ?? "unknown",
+          input: fallbackReq.params?.arguments ?? {},
+          error: errorMessage
+        });
+        return formatTokenEstimatedError(errorResult, true);
+      }
+      throw error;
+    }
+  });
+}
+
+// src/server/mcp-server/tool-registration/register-tools.ts
 var DEFAULT_MAX_TOOL_INPUT_ELEMENTS = 25e3;
 function resolveEffectiveMaxToolInputElements(configured) {
-  if (configured === void 0) {
-    return DEFAULT_MAX_TOOL_INPUT_ELEMENTS;
+  if (configured === void 0) return DEFAULT_MAX_TOOL_INPUT_ELEMENTS;
+  return configured === 0 || configured === Infinity ? Infinity : configured;
+}
+var MUTATING_TOOLS = /* @__PURE__ */ new Set([
+  "create_entry",
+  "update_entry",
+  "delete_entry",
+  "restore_entry",
+  "batch_create_entries",
+  "batch_update_entries",
+  "batch_delete_entries",
+  "team_add_member",
+  "team_update_member_role",
+  "team_remove_member"
+]);
+var toolRegistrationOptionsCache = /* @__PURE__ */ new WeakMap();
+function buildToolRegistrationOptions(tool) {
+  const cached = toolRegistrationOptionsCache.get(tool);
+  if (cached !== void 0) return cached;
+  const toolOptions = { description: tool.description };
+  if (tool.title !== void 0 && tool.title !== "") toolOptions.title = tool.title;
+  if (tool.inputSchema !== void 0) {
+    const schema = tool.inputSchema;
+    const fallbackInputSchema = schema;
+    if (typeof schema === "object" && schema !== null && "partial" in schema && typeof schema.partial === "function") {
+      try {
+        const relaxed = schema.partial();
+        toolOptions.inputSchema = typeof relaxed.passthrough === "function" ? relaxed.passthrough() : fallbackInputSchema;
+      } catch {
+        toolOptions.inputSchema = fallbackInputSchema;
+      }
+    } else {
+      toolOptions.inputSchema = fallbackInputSchema;
+    }
   }
-  if (configured === 0 || configured === Infinity) {
-    return Infinity;
+  if (tool.outputSchema !== void 0) {
+    const outSchema = tool.outputSchema;
+    const fallbackOutputSchema = outSchema;
+    if (typeof outSchema === "object" && outSchema !== null && "passthrough" in outSchema && typeof outSchema.passthrough === "function") {
+      try {
+        toolOptions.outputSchema = outSchema.passthrough();
+      } catch {
+        toolOptions.outputSchema = fallbackOutputSchema;
+      }
+    } else {
+      toolOptions.outputSchema = fallbackOutputSchema;
+    }
   }
-  return configured;
+  if (tool.annotations !== void 0) toolOptions.annotations = tool.annotations;
+  if (tool.icons !== void 0) toolOptions.icons = [{ src: tool.icons.iconUrl }];
+  toolRegistrationOptionsCache.set(tool, toolOptions);
+  return toolOptions;
 }
 function createServerInstance(context, options, prompts, resources, allTools, allToolNames, customToolHandlerConfig) {
-  const { configManager, db, teamDb, vectorManager, teamVectorManager, github, scheduler, allowedIoRoots, runtime } = context;
+  const {
+    configManager,
+    db,
+    teamDb,
+    vectorManager,
+    teamVectorManager,
+    github,
+    scheduler,
+    allowedIoRoots,
+    runtime
+  } = context;
   const { defaultProjectNumber } = options;
   const getInstructions = () => {
     const currentConfig = configManager.getConfig();
     const enabledSet = currentConfig.toolFilterConfig?.enabledTools ?? allToolNames;
     const groups = currentConfig.toolFilterConfig ? getEnabledGroups(currentConfig.toolFilterConfig.enabledTools) : void 0;
     const isCodeModeOnly = enabledSet.size === 1 && enabledSet.has("mj_execute_code");
+    const mappedPrompts = prompts.map((p) => {
+      const prompt = p;
+      return {
+        name: prompt.name,
+        ...prompt.description !== void 0 ? { description: prompt.description } : {}
+      };
+    });
     if (isCodeModeOnly || currentConfig.toolFilterConfig?.raw === "codemode") {
       const finalGroups = currentConfig.codemodeInternalFullAccess === true ? new Set(Object.keys(TOOL_GROUPS)) : groups;
       const finalEnabledTools = currentConfig.codemodeInternalFullAccess === true ? allToolNames : enabledSet;
       return generateCodeModeInstructions(
         finalEnabledTools,
-        prompts.map((p) => {
-          const prompt = p;
-          return { name: prompt.name, description: prompt.description };
-        }),
+        mappedPrompts,
         void 0,
         finalGroups,
         currentConfig.briefingConfig
@@ -2878,85 +3360,35 @@ function createServerInstance(context, options, prompts, resources, allTools, al
     }
     return generateStandardInstructions(
       enabledSet,
-      prompts.map((p) => {
-        const prompt = p;
-        return { name: prompt.name, description: prompt.description };
-      }),
+      mappedPrompts,
       void 0,
       groups,
       currentConfig.briefingConfig
     );
   };
   const server = new McpServer(
-    {
-      name: "memory-journal-mcp",
-      version: VERSION
-    },
+    { name: "memory-journal-mcp", version: VERSION },
     {
       capabilities: {
         logging: {},
         prompts: { listChanged: true },
         tools: { listChanged: true },
-        resources: {
-          subscribe: true,
-          listChanged: true
-        },
-        experimental: {
-          progress: {}
-        }
+        resources: { subscribe: true, listChanged: true },
+        experimental: { progress: {} }
       },
       instructions: getInstructions(),
       maxToolInputElements: resolveEffectiveMaxToolInputElements(options.maxToolInputElements)
     }
   );
-  if (context.skillCatalog && typeof server.isConnected === "function") {
+  if (context.skillCatalog !== void 0 && typeof server.isConnected === "function") {
     context.skillCatalog.attach(server);
   }
   for (const tool of allTools) {
-    const toolOptions = {
-      description: tool.description
-    };
-    if (tool.title) {
-      toolOptions.title = tool.title;
-    }
-    if (tool.inputSchema !== void 0) {
-      const schema = tool.inputSchema;
-      if (typeof schema === "object" && schema !== null && "partial" in schema && typeof schema.partial === "function") {
-        try {
-          const relaxed = schema.partial();
-          toolOptions.inputSchema = typeof relaxed.passthrough === "function" ? relaxed.passthrough() : schema;
-        } catch {
-          toolOptions.inputSchema = schema;
-        }
-      } else {
-        toolOptions.inputSchema = schema;
-      }
-    }
-    if (tool.outputSchema !== void 0) {
-      const outSchema = tool.outputSchema;
-      if (typeof outSchema === "object" && outSchema !== null && "passthrough" in outSchema && typeof outSchema.passthrough === "function") {
-        try {
-          toolOptions.outputSchema = outSchema.passthrough();
-        } catch {
-          toolOptions.outputSchema = outSchema;
-        }
-      } else {
-        toolOptions.outputSchema = outSchema;
-      }
-    }
-    if (tool.annotations !== void 0) {
-      toolOptions.annotations = tool.annotations;
-    }
-    if (tool.icons) {
-      toolOptions.icons = [{
-        src: tool.icons.iconUrl
-      }];
-    }
+    const toolOptions = buildToolRegistrationOptions(tool);
     const hasOutputSchema = Boolean(tool.outputSchema);
     server.registerTool(
       tool.name,
       toolOptions,
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       async (args, extra) => {
         try {
           const extraMeta = extra;
@@ -2965,7 +3397,7 @@ function createServerInstance(context, options, prompts, resources, allTools, al
           const currentConfig = configManager.getConfig();
           customToolHandlerConfig.filterConfig = currentConfig.toolFilterConfig;
           customToolHandlerConfig.briefingConfig = currentConfig.briefingConfig;
-          const toolArgs = args;
+          const toolArgs = typeof args === "object" && args !== null ? args : {};
           const result = await callTool(
             tool.name,
             toolArgs,
@@ -2979,49 +3411,31 @@ function createServerInstance(context, options, prompts, resources, allTools, al
           );
           const isSuccess = typeof result === "object" && result !== null && result["success"] === true;
           if (isSuccess) {
-            const mutatingTools = [
-              "create_entry",
-              "update_entry",
-              "delete_entry",
-              "restore_entry",
-              "batch_create_entries",
-              "batch_update_entries",
-              "batch_delete_entries",
-              "add_team_member",
-              "update_team_member",
-              "remove_team_member"
-            ];
-            const isMutation = mutatingTools.includes(tool.name) || tool.name.startsWith("team_") && tool.name !== "team_search" && tool.name !== "get_team_entry_by_id";
+            const isMutation = MUTATING_TOOLS.has(tool.name) || tool.name.startsWith("team_") && tool.annotations.readOnlyHint !== true;
             if (isMutation) {
               void globalSubscriptionManager.notifyResourceUpdated("memory://briefing");
               void globalSubscriptionManager.notifyResourceUpdated("memory://recent");
-              void globalSubscriptionManager.notifyResourceUpdated("memory://statistics");
-              if (tool.name.startsWith("team_") || tool.name.includes("team_member")) {
-                void globalSubscriptionManager.notifyResourceUpdated("memory://team/recent");
-                void globalSubscriptionManager.notifyResourceUpdated("memory://team/statistics");
+              void globalSubscriptionManager.notifyResourceUpdated(
+                "memory://statistics"
+              );
+              if (tool.name.startsWith("team_")) {
+                void globalSubscriptionManager.notifyResourceUpdated(
+                  "memory://team/recent"
+                );
+                void globalSubscriptionManager.notifyResourceUpdated(
+                  "memory://team/statistics"
+                );
               }
             }
           }
           const textContent = typeof result === "string" ? result : JSON.stringify(result, null, 2);
           if (hasOutputSchema) {
             return {
-              content: [
-                {
-                  type: "text",
-                  text: textContent
-                }
-              ],
+              content: [{ type: "text", text: textContent }],
               structuredContent: result
             };
           }
-          return {
-            content: [
-              {
-                type: "text",
-                text: textContent
-              }
-            ]
-          };
+          return { content: [{ type: "text", text: textContent }] };
         } catch (error) {
           let errorResult;
           if (error instanceof Error && "toResponse" in error && typeof error.toResponse === "function") {
@@ -3058,12 +3472,11 @@ function createServerInstance(context, options, prompts, resources, allTools, al
   }
   const handleResourceRead = async (uri, mimeType) => {
     const currentConfig = configManager.getConfig();
+    const resolvedDefaultProj = currentConfig.briefingConfig.defaultProjectNumber ?? defaultProjectNumber;
     const activeBriefingConfig = {
       ...currentConfig.briefingConfig,
-      // Ensure defaultProjectNumber is available to resource handlers
-      // (may come via briefingConfig from CLI, or directly from server options)
-      defaultProjectNumber: currentConfig.briefingConfig.defaultProjectNumber ?? defaultProjectNumber,
-      projectRegistry: options.projectRegistry,
+      ...resolvedDefaultProj !== void 0 ? { defaultProjectNumber: resolvedDefaultProj } : {},
+      ...options.projectRegistry !== void 0 ? { projectRegistry: options.projectRegistry } : {},
       allowedIoRoots
     };
     try {
@@ -3086,7 +3499,7 @@ function createServerInstance(context, options, prompts, resources, allTools, al
             uri: uri.href,
             mimeType,
             text: dataStr,
-            ...result.annotations ? { annotations: result.annotations } : {}
+            ...result.annotations !== void 0 ? { annotations: result.annotations } : {}
           }
         ]
       };
@@ -3097,845 +3510,46 @@ function createServerInstance(context, options, prompts, resources, allTools, al
   };
   registerResources(server, resources, handleResourceRead, runtime);
   server.server.setRequestHandler("resources/subscribe", (request2, extra) => {
-    const transportSessionId = extra?.sessionId || "stdio";
+    const sessionId = extra?.sessionId;
+    const transportSessionId = sessionId !== void 0 && sessionId !== "" ? sessionId : "stdio";
     validateResourceSubscription(request2.params.uri, runtime);
     globalSubscriptionManager.registerServer(transportSessionId, server);
     globalSubscriptionManager.subscribe(request2.params.uri, transportSessionId);
     return {};
   });
   server.server.setRequestHandler("resources/unsubscribe", (request2, extra) => {
-    const transportSessionId = extra?.sessionId || "stdio";
+    const sessionId = extra?.sessionId;
+    const transportSessionId = sessionId !== void 0 && sessionId !== "" ? sessionId : "stdio";
     globalSubscriptionManager.unsubscribe(request2.params.uri, transportSessionId);
     return {};
   });
   const briefingConfig = configManager.getConfig().briefingConfig;
-  registerPrompts(server, prompts, db, teamDb ?? void 0, runtime, context.github, briefingConfig);
+  registerPrompts(
+    server,
+    prompts,
+    db,
+    teamDb ?? void 0,
+    runtime,
+    context.github,
+    briefingConfig
+  );
   const serverObj = server.server;
   const requestHandlers = serverObj._requestHandlers;
-  const listToolsHandler = requestHandlers?.get("tools/list");
-  if (listToolsHandler) {
-    requestHandlers.set("tools/list", async (request2, extra) => {
-      const currentConfig = configManager.getConfig();
-      const enabledSet = currentConfig.toolFilterConfig?.enabledTools ?? allToolNames;
-      const result = await listToolsHandler(request2, extra);
-      const res = result;
-      if (Array.isArray(res?.tools)) {
-        res.tools = res.tools.filter((t) => enabledSet.has(t.name));
-      }
-      return result;
-    });
-  }
-  const originalHandler = requestHandlers?.get("tools/call");
-  if (originalHandler) {
-    requestHandlers.set("tools/call", async (request2, extra) => {
-      try {
-        const req = request2;
-        const healingEnabled = options.agentHealing !== false && customToolHandlerConfig.agentHealing !== false;
-        if (req?.params?.arguments && healingEnabled) {
-          const deepCamelToSnake = (obj) => {
-            if (Array.isArray(obj)) return obj.map(deepCamelToSnake);
-            if (obj !== null && typeof obj === "object") {
-              const newObj = {};
-              for (const [k, v] of Object.entries(obj)) {
-                const snakeKey = k.replace(/^[A-Z]/, (letter) => letter.toLowerCase()).replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-                newObj[snakeKey] = deepCamelToSnake(v);
-              }
-              return newObj;
-            }
-            return obj;
-          };
-          req.params.arguments = deepCamelToSnake(req.params.arguments);
-          const toolArgs = req.params.arguments;
-          if (typeof toolArgs["project_number"] === "undefined") {
-            let repoStr;
-            if (typeof toolArgs["repo"] === "string") repoStr = toolArgs["repo"];
-            else if (typeof toolArgs["project"] === "string") repoStr = toolArgs["project"];
-            if (repoStr) {
-              toolArgs["project_number"] = repoStr;
-            }
-          }
-          if (typeof toolArgs["project_number"] === "string") {
-            const strVal = toolArgs["project_number"];
-            const parsed = Number(strVal);
-            if (!Number.isNaN(parsed)) {
-              toolArgs["project_number"] = parsed;
-            } else if (options.projectRegistry) {
-              let entry = options.projectRegistry[strVal];
-              if (!entry && strVal.includes("/")) {
-                const repoName = strVal.split("/").pop();
-                if (repoName) {
-                  entry = options.projectRegistry[repoName];
-                }
-              }
-              if (entry?.project_number !== void 0) {
-                toolArgs["project_number"] = entry.project_number;
-              }
-            }
-          }
-          const ALIASED_EXECUTE_CODE_NAMES = /* @__PURE__ */ new Set([
-            "mysql_execute_code",
-            "mysqlExecuteCode",
-            "execute_code",
-            "executeCode",
-            "mjExecuteCode",
-            "mj_eval",
-            "eval_code",
-            "run_code",
-            "exec_code",
-            "code_execute"
-          ]);
-          if (req.params.name && ALIASED_EXECUTE_CODE_NAMES.has(req.params.name)) {
-            req.params.name = "mj_execute_code";
-          }
-          if (req.params.name === "create_entry_minimal") {
-            req.params.name = "create_entry";
-            if (typeof toolArgs["entry_type"] === "undefined") {
-              toolArgs["entry_type"] = "personal_reflection";
-            }
-          }
-          const ALIASED_LIST_PROJECTS_NAMES = /* @__PURE__ */ new Set([
-            "listProjects",
-            "list-projects",
-            "get_projects",
-            "getProjects",
-            "get-projects",
-            "mj_list_projects",
-            "mjListProjects",
-            "mj_get_projects",
-            "mjGetProjects",
-            "mj_admin_list_projects",
-            "mj_admin_get_projects"
-          ]);
-          if (req.params.name && ALIASED_LIST_PROJECTS_NAMES.has(req.params.name)) {
-            req.params.name = "list_projects";
-          }
-          const ALIASED_GET_PROJECT_NAMES = /* @__PURE__ */ new Set([
-            "getProject",
-            "get-project",
-            "mj_get_project",
-            "mjGetProject",
-            "mj_admin_get_project"
-          ]);
-          if (req.params.name && ALIASED_GET_PROJECT_NAMES.has(req.params.name)) {
-            req.params.name = "get_project";
-          }
-          const ALIASED_GREP_SEARCH_NAMES = /* @__PURE__ */ new Set([
-            "grep_search",
-            "grepSearch",
-            "grep",
-            "file_search",
-            "fileSearch",
-            "find_in_files",
-            "findInFiles",
-            "search_files",
-            "searchFiles"
-          ]);
-          if (req.params.name && ALIASED_GREP_SEARCH_NAMES.has(req.params.name)) {
-            req.params.name = "grep_search";
-          }
-          const ALIASED_VIEW_FILE_NAMES = /* @__PURE__ */ new Set([
-            "view_file",
-            "viewFile",
-            "read_file",
-            "readFile",
-            "get_file",
-            "getFile"
-          ]);
-          if (req.params.name && ALIASED_VIEW_FILE_NAMES.has(req.params.name)) {
-            req.params.name = "view_file";
-          }
-          const ALIASED_LIST_DIR_NAMES = /* @__PURE__ */ new Set([
-            "list_dir",
-            "listDir",
-            "read_dir",
-            "readDir"
-          ]);
-          if (req.params.name && ALIASED_LIST_DIR_NAMES.has(req.params.name)) {
-            req.params.name = "list_dir";
-          }
-          if (req.params.name) {
-            const intercept = applyArgInterceptions(req.params.name, [toolArgs]);
-            if ("error" in intercept) {
-              const errorResult = intercept.error;
-              logAgentIssue({
-                source: "MCP",
-                action: req.params.name,
-                input: toolArgs,
-                error: errorResult["error"] ?? "Validation Error"
-              });
-              const enriched = JSON.stringify({
-                ...errorResult,
-                _meta: { tokenEstimate: 0 }
-              });
-              const tokenEstimate = Math.ceil(Buffer.byteLength(enriched, "utf8") / 4);
-              const finalText = enriched.replace('"tokenEstimate":0', `"tokenEstimate":${tokenEstimate}`);
-              return {
-                content: [
-                  {
-                    type: "text",
-                    text: finalText
-                  }
-                ],
-                structuredContent: errorResult
-              };
-            } else {
-              const normalizedArgs = intercept.args?.[0];
-              if (normalizedArgs !== null && typeof normalizedArgs === "object" && !Array.isArray(normalizedArgs)) {
-                req.params.arguments = normalizedArgs;
-              }
-            }
-          }
-        }
-        if (req?.params?.name && !allToolNames.has(req.params.name)) {
-          const requestedTool = req.params.name;
-          const toolArgs = req.params.arguments ?? {};
-          const normalized = requestedTool.replace(/^mj_/, "").replace(/_/g, "-");
-          const matchingPrompt = prompts.find((p) => p.name === normalized || p.name === requestedTool || p.name === requestedTool.replace(/^mj_/, ""));
-          if (healingEnabled) {
-            if (matchingPrompt) {
-              try {
-                const stringArgs = {};
-                for (const [k, v] of Object.entries(toolArgs)) {
-                  if (typeof v === "string") stringArgs[k] = v;
-                  else if (typeof v === "number" || typeof v === "boolean") stringArgs[k] = String(v);
-                }
-                if ((matchingPrompt.name === "load-briefing" || matchingPrompt.name === "briefing") && !stringArgs["projects"]) {
-                  const fallbackProject = stringArgs["project"] ?? stringArgs["name"] ?? stringArgs["target"] ?? stringArgs["repo"] ?? stringArgs["workspace"] ?? "";
-                  stringArgs["projects"] = fallbackProject;
-                }
-                const currentConfig = configManager.getConfig();
-                const promptResult = await getPrompt(
-                  matchingPrompt.name,
-                  stringArgs,
-                  db,
-                  teamDb ?? void 0,
-                  github ?? void 0,
-                  currentConfig.briefingConfig
-                );
-                const successPayload = {
-                  success: true,
-                  data: promptResult,
-                  messages: promptResult.messages,
-                  _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' is an MCP Prompt, but was invoked directly as an MCP tool. The prompt was evaluated and returned successfully.`
-                };
-                const enriched2 = JSON.stringify(successPayload, null, 2);
-                return {
-                  content: [
-                    {
-                      type: "text",
-                      text: enriched2
-                    }
-                  ],
-                  structuredContent: successPayload
-                };
-              } catch {
-              }
-            }
-            const isResource = requestedTool === "read_resource" || requestedTool === "readResource" || requestedTool === "read-resource" || requestedTool === "mj_read_resource" || requestedTool === "mjReadResource" || requestedTool === "memory_read_resource" || requestedTool === "memoryReadResource" || requestedTool === "memory_journal_read_resource" || requestedTool === "get_resource" || requestedTool === "getResource" || requestedTool === "get-resource" || requestedTool === "memory_get_resource" || requestedTool === "memoryGetResource" || requestedTool === "mj_get_resource" || requestedTool === "mjGetResource" || requestedTool === "read_memory_resource" || requestedTool.endsWith("_read_resource") || requestedTool.endsWith("ReadResource") || requestedTool.startsWith("memory://");
-            if (isResource) {
-              try {
-                let uri = typeof toolArgs["uri"] === "string" ? toolArgs["uri"] : typeof toolArgs["Uri"] === "string" ? toolArgs["Uri"] : typeof toolArgs["_uri"] === "string" ? toolArgs["_uri"] : void 0;
-                if (!uri) {
-                  for (const key of ["resourceUri", "resource_uri", "resource", "Resource", "url", "Url", "path", "Path", "name", "Name", "target", "Target", "ServerName", "server_name"]) {
-                    const rawVal = toolArgs[key];
-                    if (typeof rawVal === "string" && rawVal.trim()) {
-                      const val = rawVal.trim();
-                      if (key === "ServerName" || key === "server_name") {
-                        if (val === "memory-journal-mcp" || val === "memory-journal") continue;
-                      }
-                      uri = val;
-                      break;
-                    }
-                  }
-                }
-                if (!uri && requestedTool.startsWith("memory://")) {
-                  uri = requestedTool;
-                }
-                if (uri && !uri.includes("://")) {
-                  if (uri.startsWith("briefing") || uri.startsWith("recent") || uri.startsWith("agent-") || uri.startsWith("statistics") || uri.startsWith("insights") || uri.startsWith("help") || uri.startsWith("health") || uri.startsWith("team") || uri.startsWith("git") || uri.startsWith("tools")) {
-                    uri = `memory://${uri}`;
-                  } else {
-                    uri = `memory://briefing/${uri}`;
-                  }
-                }
-                if (!uri) {
-                  uri = "memory://briefing";
-                }
-                const currentConfig = configManager.getConfig();
-                const res = await readResource(
-                  uri,
-                  db,
-                  vectorManager ?? void 0,
-                  currentConfig.toolFilterConfig,
-                  github ?? void 0,
-                  void 0,
-                  teamDb ?? void 0,
-                  currentConfig.briefingConfig,
-                  runtime
-                );
-                const successPayload = {
-                  success: true,
-                  data: res.data,
-                  _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' was called as an MCP tool instead of an MCP resource read. The resource '${uri}' was resolved successfully.`
-                };
-                const enriched2 = JSON.stringify(successPayload, null, 2);
-                return {
-                  content: [
-                    {
-                      type: "text",
-                      text: enriched2
-                    }
-                  ],
-                  structuredContent: successPayload
-                };
-              } catch {
-              }
-            }
-            const isListResources = requestedTool === "list_resources" || requestedTool === "listResources" || requestedTool === "list-resources" || requestedTool === "mj_list_resources" || requestedTool === "mjListResources" || requestedTool === "memory_list_resources" || requestedTool === "memoryListResources" || requestedTool === "memory_journal_list_resources" || requestedTool === "get_resources" || requestedTool === "getResources" || requestedTool === "get-resources" || requestedTool === "memory_get_resources" || requestedTool === "memoryGetResources" || requestedTool.endsWith("_list_resources") || requestedTool.endsWith("ListResources");
-            if (isListResources) {
-              try {
-                const resourceList = getResources();
-                const successPayload = {
-                  success: true,
-                  resources: resourceList,
-                  _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' was called as an MCP tool instead of an MCP protocol request (resources/list). The available resources were returned successfully.`
-                };
-                const enriched2 = JSON.stringify(successPayload, null, 2);
-                return {
-                  content: [
-                    {
-                      type: "text",
-                      text: enriched2
-                    }
-                  ],
-                  structuredContent: successPayload
-                };
-              } catch {
-              }
-            }
-            const isListPrompts = requestedTool === "list_prompts" || requestedTool === "listPrompts" || requestedTool === "list-prompts" || requestedTool === "mj_list_prompts" || requestedTool === "mjListPrompts" || requestedTool === "memory_list_prompts" || requestedTool === "memoryListPrompts" || requestedTool === "memory_journal_list_prompts" || requestedTool === "get_prompts" || requestedTool === "getPrompts" || requestedTool.endsWith("_list_prompts") || requestedTool.endsWith("ListPrompts");
-            if (isListPrompts) {
-              try {
-                const promptList = getPrompts();
-                const successPayload = {
-                  success: true,
-                  prompts: promptList,
-                  _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' was called as an MCP tool instead of an MCP protocol request (prompts/list). The available prompts were returned successfully.`
-                };
-                const enriched2 = JSON.stringify(successPayload, null, 2);
-                return {
-                  content: [
-                    {
-                      type: "text",
-                      text: enriched2
-                    }
-                  ],
-                  structuredContent: successPayload
-                };
-              } catch {
-              }
-            }
-            const isListTools = requestedTool === "list_tools" || requestedTool === "listTools" || requestedTool === "list-tools" || requestedTool === "mj_list_tools" || requestedTool === "mjListTools" || requestedTool === "memory_list_tools" || requestedTool === "memoryListTools" || requestedTool === "memory_journal_list_tools" || requestedTool === "get_tools" || requestedTool === "getTools" || requestedTool.endsWith("_list_tools") || requestedTool.endsWith("ListTools");
-            if (isListTools) {
-              try {
-                const currentConfig = configManager.getConfig();
-                const enabledSet = currentConfig.toolFilterConfig?.enabledTools ?? allToolNames;
-                const toolsList = allTools.filter((t) => enabledSet.has(t.name)).map((t) => ({
-                  name: t.name,
-                  title: t.title,
-                  description: t.description,
-                  annotations: t.annotations
-                }));
-                const successPayload = {
-                  success: true,
-                  tools: toolsList,
-                  _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' was called as an MCP tool instead of an MCP protocol request (tools/list). The available tools were returned successfully.`
-                };
-                const enriched2 = JSON.stringify(successPayload, null, 2);
-                return {
-                  content: [
-                    {
-                      type: "text",
-                      text: enriched2
-                    }
-                  ],
-                  structuredContent: successPayload
-                };
-              } catch {
-              }
-            }
-            const isGetPrompt = requestedTool === "get_prompt" || requestedTool === "getPrompt" || requestedTool === "mj_get_prompt" || requestedTool === "mjGetPrompt" || requestedTool === "memory_get_prompt" || requestedTool === "memoryGetPrompt" || requestedTool === "memory_journal_get_prompt" || requestedTool === "read_prompt" || requestedTool === "readPrompt" || requestedTool.endsWith("_get_prompt") || requestedTool.endsWith("GetPrompt");
-            if (isGetPrompt) {
-              try {
-                const targetPromptName = typeof toolArgs["name"] === "string" ? toolArgs["name"] : typeof toolArgs["prompt"] === "string" ? toolArgs["prompt"] : typeof toolArgs["prompt_name"] === "string" ? toolArgs["prompt_name"] : "load-briefing";
-                const nestedArgs = typeof toolArgs["arguments"] === "object" && toolArgs["arguments"] !== null ? toolArgs["arguments"] : toolArgs;
-                const stringArgs = {};
-                for (const [k, v] of Object.entries(nestedArgs)) {
-                  if (k !== "name" && k !== "prompt" && k !== "prompt_name" && k !== "arguments") {
-                    if (typeof v === "string") stringArgs[k] = v;
-                    else if (typeof v === "number" || typeof v === "boolean") stringArgs[k] = String(v);
-                  }
-                }
-                const currentConfig = configManager.getConfig();
-                const promptResult = await getPrompt(
-                  targetPromptName,
-                  stringArgs,
-                  db,
-                  teamDb ?? void 0,
-                  github ?? void 0,
-                  currentConfig.briefingConfig
-                );
-                const successPayload = {
-                  success: true,
-                  data: promptResult,
-                  messages: promptResult.messages,
-                  _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' was called as an MCP tool instead of an MCP protocol request (prompts/get). The prompt '${targetPromptName}' was evaluated successfully.`
-                };
-                const enriched2 = JSON.stringify(successPayload, null, 2);
-                return {
-                  content: [
-                    {
-                      type: "text",
-                      text: enriched2
-                    }
-                  ],
-                  structuredContent: successPayload
-                };
-              } catch {
-              }
-            }
-            const isServerInfo = [
-              "server_info",
-              "serverInfo",
-              "server-info",
-              "mj_server_info",
-              "get_server_info",
-              "getServerInfo",
-              "server_health",
-              "serverHealth",
-              "server-health",
-              "mj_server_health",
-              "get_server_health",
-              "getServerHealth",
-              "health_check",
-              "healthCheck",
-              "health-check",
-              "server_status",
-              "serverStatus",
-              "server-status",
-              "status",
-              "health"
-            ].includes(requestedTool);
-            if (isServerInfo) {
-              try {
-                let healthData;
-                try {
-                  const res = await readResource(
-                    "memory://health",
-                    db,
-                    vectorManager ?? void 0,
-                    configManager.getConfig().toolFilterConfig ?? void 0,
-                    github ?? void 0,
-                    void 0,
-                    teamDb ?? void 0,
-                    configManager.getConfig().briefingConfig,
-                    runtime
-                  );
-                  if (typeof res.data === "object" && res.data !== null) {
-                    healthData = res.data;
-                  }
-                } catch {
-                }
-                const dbHealth = healthData ?? db.getHealthStatus();
-                const successPayload = {
-                  success: true,
-                  status: "healthy",
-                  server: {
-                    name: "memory-journal-mcp",
-                    version: VERSION,
-                    description: "Memory Journal MCP Server with Code Mode & Semantic Search"
-                  },
-                  runtime: {
-                    nodeVersion: process.version,
-                    platform: process.platform,
-                    uptimeSeconds: Math.floor(process.uptime())
-                  },
-                  ...healthData !== void 0 ? { health: healthData } : {},
-                  ...dbHealth !== void 0 ? { database: dbHealth } : {},
-                  capabilities: {
-                    codemode: true,
-                    resources: true,
-                    prompts: true,
-                    tools: true
-                  },
-                  _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' was called as an MCP tool. Returned server diagnostic information and health status successfully.`
-                };
-                const enriched2 = JSON.stringify(successPayload, null, 2);
-                return {
-                  content: [
-                    {
-                      type: "text",
-                      text: enriched2
-                    }
-                  ],
-                  structuredContent: successPayload
-                };
-              } catch {
-              }
-            }
-            const isListProjects = [
-              "list_projects",
-              "listProjects",
-              "list-projects",
-              "get_projects",
-              "getProjects",
-              "get-projects",
-              "mj_list_projects",
-              "mjListProjects",
-              "mj_get_projects",
-              "mjGetProjects",
-              "mj_admin_list_projects",
-              "mj_admin_get_projects",
-              "projects"
-            ].includes(requestedTool) || requestedTool.endsWith("list_projects") || requestedTool.endsWith("listProjects") || requestedTool.endsWith("ListProjects");
-            if (isListProjects) {
-              try {
-                const currentConfig = configManager.getConfig();
-                const registry = currentConfig.projectRegistry ?? {};
-                const successPayload = {
-                  success: true,
-                  projects: registry,
-                  _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' was called as an MCP tool. Returned registered projects from projectRegistry successfully.`
-                };
-                const enriched2 = JSON.stringify(successPayload, null, 2);
-                return {
-                  content: [
-                    {
-                      type: "text",
-                      text: enriched2
-                    }
-                  ],
-                  structuredContent: successPayload
-                };
-              } catch {
-              }
-            }
-            const isListAdapters = [
-              "list_adapters",
-              "listAdapters",
-              "list-adapters",
-              "mj_list_adapters",
-              "mjListAdapters",
-              "get_adapters",
-              "getAdapters",
-              "get-adapters",
-              "adapters"
-            ].includes(requestedTool) || requestedTool.endsWith("list_adapters") || requestedTool.endsWith("listAdapters") || requestedTool.endsWith("ListAdapters");
-            if (isListAdapters) {
-              try {
-                const adapters = [
-                  {
-                    name: "sqlite",
-                    type: "database",
-                    driver: "better-sqlite3",
-                    status: "connected",
-                    primary: true,
-                    description: "Primary SQLite storage engine for journal entries, tags, and relationships"
-                  },
-                  {
-                    name: "sqlite-vec",
-                    type: "vector",
-                    driver: "sqlite-vec",
-                    status: vectorManager !== void 0 && vectorManager !== null ? "connected" : "ready",
-                    description: "Native vector embeddings and semantic search engine"
-                  },
-                  {
-                    name: "team",
-                    type: "database",
-                    driver: "better-sqlite3",
-                    status: teamDb !== void 0 && teamDb !== null ? "connected" : "disabled",
-                    description: "Collaborative team journal database adapter"
-                  },
-                  {
-                    name: "github",
-                    type: "integration",
-                    driver: "octokit / gh",
-                    status: github !== void 0 && github !== null ? "connected" : "disabled",
-                    description: "GitHub synchronization and issue tracking adapter"
-                  }
-                ];
-                const successPayload = {
-                  success: true,
-                  adapters,
-                  default_adapter: "sqlite",
-                  _healing_note: `\u{1F6E0}\uFE0F AUTONOMOUS HEALING: '${requestedTool}' was called as an MCP tool. Returned registered database and service adapters successfully.`
-                };
-                const enriched2 = JSON.stringify(successPayload, null, 2);
-                return {
-                  content: [
-                    {
-                      type: "text",
-                      text: enriched2
-                    }
-                  ],
-                  structuredContent: successPayload
-                };
-              } catch {
-              }
-            }
-            const isGrepSearch = [
-              "grep_search",
-              "grepSearch",
-              "grep",
-              "file_search",
-              "fileSearch",
-              "find_in_files",
-              "findInFiles",
-              "search_files",
-              "searchFiles"
-            ].includes(requestedTool) || requestedTool.endsWith("grep_search") || requestedTool.endsWith("grepSearch");
-            if (isGrepSearch) {
-              try {
-                const dummyTools = getDummyHealingTools({ db, teamDb: teamDb ?? void 0, vectorManager: vectorManager ?? void 0, teamVectorManager: teamVectorManager ?? void 0, github: github ?? void 0, config: customToolHandlerConfig });
-                const grepTool = dummyTools.find((t) => t.name === "grep_search");
-                if (grepTool) {
-                  const res = await Promise.resolve(grepTool.handler(toolArgs));
-                  const enriched2 = JSON.stringify(res, null, 2);
-                  return {
-                    content: [
-                      {
-                        type: "text",
-                        text: enriched2
-                      }
-                    ],
-                    structuredContent: res
-                  };
-                }
-              } catch {
-              }
-            }
-            const isViewFile = [
-              "view_file",
-              "viewFile",
-              "read_file",
-              "readFile",
-              "get_file",
-              "getFile",
-              "cat"
-            ].includes(requestedTool);
-            if (isViewFile) {
-              try {
-                const dummyTools = getDummyHealingTools({ db, teamDb: teamDb ?? void 0, vectorManager: vectorManager ?? void 0, teamVectorManager: teamVectorManager ?? void 0, github: github ?? void 0, config: customToolHandlerConfig });
-                const viewTool = dummyTools.find((t) => t.name === "view_file");
-                if (viewTool) {
-                  const res = await Promise.resolve(viewTool.handler(toolArgs));
-                  const enriched2 = JSON.stringify(res, null, 2);
-                  return {
-                    content: [
-                      {
-                        type: "text",
-                        text: enriched2
-                      }
-                    ],
-                    structuredContent: res
-                  };
-                }
-              } catch {
-              }
-            }
-            const isListDir = [
-              "list_dir",
-              "listDir",
-              "read_dir",
-              "readDir",
-              "ls",
-              "dir"
-            ].includes(requestedTool);
-            if (isListDir) {
-              try {
-                const dummyTools = getDummyHealingTools({ db, teamDb: teamDb ?? void 0, vectorManager: vectorManager ?? void 0, teamVectorManager: teamVectorManager ?? void 0, github: github ?? void 0, config: customToolHandlerConfig });
-                const dirTool = dummyTools.find((t) => t.name === "list_dir");
-                if (dirTool) {
-                  const res = await Promise.resolve(dirTool.handler(toolArgs));
-                  const enriched2 = JSON.stringify(res, null, 2);
-                  return {
-                    content: [
-                      {
-                        type: "text",
-                        text: enriched2
-                      }
-                    ],
-                    structuredContent: res
-                  };
-                }
-              } catch {
-              }
-            }
-          }
-          let suggestion = `Tool '${requestedTool}' does not exist. Use tools/list to see available tools.`;
-          const isFilteredTool = Object.values(TOOL_GROUPS).flat().includes(requestedTool);
-          if (isFilteredTool) {
-            suggestion = `'${requestedTool}' is a valid tool but it is not currently exposed because of your active --tool-filter or codemode restrictions. If you are in Code Mode, invoke it via 'mj_execute_code' (e.g. 'await mj.core.${requestedTool}(...)').`;
-          } else if (matchingPrompt !== void 0) {
-            suggestion = `'${requestedTool}' is an MCP Prompt, not an MCP Tool. Please use the 'get_prompt' tool (or your native MCP Prompts integration) to evaluate it, then use 'create_entry' to save the result.`;
-          } else if (requestedTool.startsWith("mj_")) {
-            suggestion = `'${requestedTool}' is not a valid root tool. If you are trying to use Code Mode, you must invoke the 'mj_execute_code' tool and write javascript (e.g. 'await mj.core.searchEntries(...)').`;
-          }
-          const errorResult = {
-            success: false,
-            error: `MCP error -32602: Tool ${requestedTool} not found`,
-            code: "TOOL_NOT_FOUND",
-            category: "hallucination",
-            suggestion,
-            recoverable: false
-          };
-          if (healingEnabled) {
-            logAgentIssue({
-              source: "MCP",
-              action: requestedTool,
-              input: toolArgs,
-              error: errorResult.error
-            });
-          }
-          const enriched = JSON.stringify({
-            ...errorResult,
-            _meta: { tokenEstimate: 0 }
-          });
-          const tokenEstimate = Math.ceil(Buffer.byteLength(enriched, "utf8") / 4);
-          const finalText = enriched.replace('"tokenEstimate":0', `"tokenEstimate":${tokenEstimate}`);
-          return {
-            content: [
-              {
-                type: "text",
-                text: finalText
-              }
-            ],
-            structuredContent: errorResult,
-            isError: true
-          };
-        }
-        const result = await originalHandler(request2, extra);
-        if (result !== null && result !== void 0 && typeof result === "object" && "isError" in result && result.isError === true) {
-          const resObj = result;
-          if (Array.isArray(resObj.content) && resObj.content.length > 0) {
-            const text = resObj.content[0]?.text;
-            if (typeof text === "string" && text.includes("MCP error -32602")) {
-              let errorMessage = text.replace(
-                "MCP error -32602: Input validation error: ",
-                ""
-              );
-              try {
-                const parts = text.split(": [");
-                if (parts.length > 1) {
-                  const zodErrors = JSON.parse("[" + parts[1]);
-                  const formattedErrors = zodErrors.map((e) => {
-                    const path2 = e.path && e.path.length > 0 ? e.path.join(".") : "unknown";
-                    return `${path2}: ${e.message || "invalid"}`;
-                  }).join("; ");
-                  errorMessage = formattedErrors;
-                }
-              } catch {
-              }
-              const errorResult = {
-                success: false,
-                error: errorMessage,
-                code: "VALIDATION_ERROR",
-                category: "validation",
-                suggestion: "Check input parameters against the tool schema",
-                recoverable: false
-              };
-              logAgentIssue({
-                source: "MCP",
-                action: req.params?.name ?? "unknown",
-                input: req.params?.arguments ?? {},
-                error: errorMessage
-              });
-              const enriched = JSON.stringify({
-                ...errorResult,
-                _meta: { tokenEstimate: 0 }
-              });
-              const tokenEstimate = Math.ceil(
-                Buffer.byteLength(enriched, "utf8") / 4
-              );
-              const finalText = enriched.replace(
-                '"tokenEstimate":0',
-                `"tokenEstimate":${tokenEstimate}`
-              );
-              return {
-                content: [
-                  {
-                    type: "text",
-                    text: finalText
-                  }
-                ],
-                structuredContent: errorResult
-              };
-            }
-          }
-        }
-        return result;
-      } catch (error) {
-        const err = error;
-        if (err?.code === -32602) {
-          let errorMessage = err.message || "Validation Error";
-          if (typeof errorMessage === "string" && errorMessage.includes("Invalid arguments for tool")) {
-            try {
-              const parts = errorMessage.split(": [");
-              if (parts.length > 1) {
-                const zodErrors = JSON.parse("[" + parts[1]);
-                const formattedErrors = zodErrors.map((e) => {
-                  const path2 = e.path && e.path.length > 0 ? e.path.join(".") : "unknown";
-                  return `${path2}: ${e.message || "invalid"}`;
-                }).join("; ");
-                errorMessage = formattedErrors;
-              }
-            } catch {
-            }
-          }
-          const errorResult = {
-            success: false,
-            error: errorMessage,
-            code: "VALIDATION_ERROR",
-            category: "validation",
-            suggestion: "Check input parameters against the tool schema",
-            recoverable: false
-          };
-          const fallbackReq = request2;
-          logAgentIssue({
-            source: "MCP",
-            action: fallbackReq?.params?.name ?? "unknown",
-            input: fallbackReq?.params?.arguments ?? {},
-            error: errorMessage
-          });
-          const enriched = JSON.stringify({
-            ...errorResult,
-            _meta: { tokenEstimate: 0 }
-          });
-          const tokenEstimate = Math.ceil(Buffer.byteLength(enriched, "utf8") / 4);
-          const finalText = enriched.replace(
-            '"tokenEstimate":0',
-            `"tokenEstimate":${tokenEstimate}`
-          );
-          return {
-            content: [
-              {
-                type: "text",
-                text: finalText
-              }
-            ],
-            structuredContent: errorResult,
-            isError: true
-          };
-        }
-        throw error;
-      }
-    });
-  }
+  attachListToolsInterceptor(requestHandlers, configManager, allToolNames);
+  attachCallToolInterceptor(
+    requestHandlers,
+    context,
+    options,
+    prompts,
+    allTools,
+    allToolNames,
+    customToolHandlerConfig
+  );
   return server;
 }
-function startMetricsServer(runtime) {
+function startMetricsServer(runtime, metricsPort) {
   const portStr = process.env["MJ_METRICS_PORT"];
-  const port = portStr ? parseInt(portStr, 10) : 9465;
+  const port = metricsPort ?? (portStr !== void 0 && portStr !== "" ? parseInt(portStr, 10) : 9465);
   const server = http.createServer((req, res) => {
     if (req.url === "/metrics" && req.method === "GET") {
       try {
@@ -3963,8 +3577,10 @@ function startMetricsServer(runtime) {
       logger.error("Metrics server error", { error: error instanceof Error ? error.message : String(error), module: "MetricsServer" });
     }
   });
-  server.listen(port, "0.0.0.0", () => {
-    logger.info(`Standalone metrics server listening on port ${port}`, { module: "MetricsServer" });
+  const rawHost = process.env["MJ_METRICS_HOST"]?.trim();
+  const host = rawHost !== void 0 && rawHost !== "" ? rawHost : "127.0.0.1";
+  server.listen(port, host, () => {
+    logger.info(`Standalone metrics server listening on ${host}:${port}`, { module: "MetricsServer" });
   });
   return () => {
     return new Promise((resolve, reject) => {
@@ -4002,7 +3618,11 @@ async function createServer2(options) {
     teamDefaultRole: options.teamDefaultRole,
     teamAdmin: options.teamAdmin,
     runtime,
-    subscriptionManager: globalSubscriptionManager
+    subscriptionManager: globalSubscriptionManager,
+    archiveOlderThanDays: options.archiveOlderThanDays,
+    pruneOlderThanDays: options.pruneOlderThanDays,
+    hardDeleteOlderThanDays: options.hardDeleteOlderThanDays,
+    pruneImportanceThreshold: options.pruneImportanceThreshold
   };
   const dispatch = (name, args) => callTool(
     name,
@@ -4031,7 +3651,11 @@ async function createServer2(options) {
   }
   const resources = getResources();
   const prompts = getPrompts();
-  configManager.on("changed", () => {
+  configManager.on("changed", (newConfig) => {
+    baseConfig.filterConfig = newConfig.toolFilterConfig;
+    baseConfig.briefingConfig = newConfig.briefingConfig;
+    customToolHandlerConfig.filterConfig = newConfig.toolFilterConfig;
+    customToolHandlerConfig.briefingConfig = newConfig.briefingConfig;
     void globalSubscriptionManager.notifyResourceUpdated("memory://briefing");
     try {
       void globalSubscriptionManager.broadcastNotification("notifications/tools/list_changed");
@@ -4054,7 +3678,7 @@ async function createServer2(options) {
   );
   let shutdownMetrics;
   if (options.metricsExport === "prometheus") {
-    shutdownMetrics = startMetricsServer(runtime);
+    shutdownMetrics = startMetricsServer(runtime, options.metricsPort);
   }
   if (transport === "stdio") {
     const stdioTransport = new StdioServerTransport();
@@ -4139,4 +3763,4 @@ async function createServer2(options) {
   }
 }
 
-export { VectorSearchManager, createServer2 as createServer, globalSubscriptionManager, initializeDependencies };
+export { VectorSearchManager, createServer2 as createServer, initializeDependencies };