openwriter 0.26.0 → 0.27.1

package/dist/server/mcp.js

@@ -10,22 +10,23 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import { getDataDir, ensureDataDir, resolveDocPath, generateNodeId, atomicWriteFileSync } from './helpers.js';
-import { getDocument, getWordCount, getPendingChangeCount, getTitle, getStatus, getNodesByIds, findNodesByIds, getMetadata, setMetadata, mergeMetadataUpdates, applyChanges, applyTextEdits, updateDocument, save, markAllNodesAsPending, setAgentLock, setAgentLockActive, updatePendingCacheForActiveDoc, populateDocumentFile, applyChangesToFile, applyTextEditsToFile, getDocId, getFilePath, extractText, countPending, addDocTag, removeDocTag, getCachedDocument, invalidateDocCache, isAutoAcceptActive, removePendingCacheEntry, getExternalMtimeDrift, reloadActiveDocFromDisk, getCanonical, cloneWithPendingReverted, bumpDocVersion, setSortProposalOnFile, clearSortRequestOnFile, } from './state.js';
+import { getDocument, getWordCount, getPendingChangeCount, getTitle, getStatus, getNodesByIds, findNodesByIds, getMetadata, setMetadata, mergeMetadataUpdates, applyChanges, applyTextEdits, updateDocument, save, markAllNodesAsPending, setAgentLock, setAgentLockActive, updatePendingCacheForActiveDoc, populateDocumentFile, applyChangesToFile, applyTextEditsToFile, getDocId, getFilePath, getIsTemp, extractText, countPending, addDocTag, removeDocTag, getCachedDocument, invalidateDocCache, isAutoAcceptActive, removePendingCacheEntry, getExternalMtimeDrift, reloadActiveDocFromDisk, getCanonical, cloneWithPendingReverted, bumpDocVersion, setSortProposalOnFile, clearSortRequestOnFile, } from './state.js';
 import { tiptapToBlocks } from './node-blocks.js';
 import { outline, peek, searchInDoc, truncateRead } from './peek-outline.js';
 import { harvestSentenceHashes, harvestCharCount } from './enrichment.js';
-import { listDocuments, switchDocument, createDocument, createDocumentFile, deleteDocument, openFile, getActiveFilename, updateDocumentTitle, promoteTempFile, archiveDocument, unarchiveDocument, resolveDocId, filenameByDocId, searchDocuments, listDirtyDocs, crawlDocs, enrichmentFooter, buildEnrichmentInstructions, listPendingSorts, sortFooter, buildSortInstructions } from './documents.js';
+import { listDocuments, switchDocument, createDocument, createDocumentFile, deleteDocument, openFile, getActiveFilename, promoteTempFile, archiveDocument, unarchiveDocument, resolveDocId, filenameByDocId, searchDocuments, listDirtyDocs, crawlDocs, enrichmentFooter, buildEnrichmentInstructions, listPendingSorts, sortFooter, buildSortInstructions, stagePendingTitle } from './documents.js';
 import { readFrontmatter, writeFrontmatter, computeBacklinksFor, invalidateBacklinksCache } from './backlinks.js';
 import { logger, generateRequestId, withRequestId } from './logger.js';
-import { broadcastDocumentSwitched, broadcastDocumentsChanged, broadcastWorkspacesChanged, broadcastTitleChanged, broadcastMetadataChanged, broadcastPendingDocsChanged, broadcastWritingStarted, broadcastWritingFinished, broadcastCommentsChanged, broadcastActivityEvent } from './ws.js';
+import { broadcastDocumentSwitched, broadcastDocumentsChanged, broadcastWorkspacesChanged, broadcastTitleChanged, broadcastMetadataChanged, broadcastPendingDocsChanged, broadcastPendingMetadataChanged, broadcastWritingStarted, broadcastWritingFinished, broadcastCommentsChanged, broadcastActivityEvent } from './ws.js';
 import { listWorkspaces, getWorkspace, getDocTitle, getItemContext, addDoc, updateWorkspaceContext, createWorkspace, deleteWorkspace, addContainerToWorkspace, findOrCreateWorkspace, findOrCreateContainer, moveDoc, moveContainer, reorderWorkspaceAfter, removeContainer, renameWorkspace, renameContainer, removeDocFromAllWorkspaces, findWorkspacesContainingDoc, collectFilesInWorkspace } from './workspaces.js';
 import { findDocNode } from './workspace-tree.js';
 import { importGoogleDoc } from './gdoc-import.js';
-import { toCompactFormat, compactNodes, parseMarkdownContent, mergeParagraphsToHardBreaks } from './compact.js';
+import { toCompactFormat, compactNodes, parseMarkdownContent } from './compact.js';
 import matter from 'gray-matter';
 import { getUpdateInfo } from './update-check.js';
 import { listVersions, forceSnapshot, getVersionContent } from './versions.js';
-import { markdownToTiptap, tiptapToMarkdown } from './markdown.js';
+import { tiptapToMarkdown } from './markdown.js';
+import { loadDocFromDisk } from './pending-overlay.js';
 import { getComments, getCommentCount, getGlobalCommentSummary, resolveComments } from './comments.js';
 import { readTasks, addTask, updateTask, removeTask } from './tasks.js';
 /** Map a content type string to its frontmatter metadata object. */
@@ -41,24 +42,6 @@ function resolveTypeMeta(type, url) {
         default: return undefined;
     }
 }
-/** Check if a document is in tweet compose mode (has tweetContext metadata). */
-function isTweetDoc(filename) {
-    if (!filename || filename === getActiveFilename()) {
-        return !!getMetadata()?.tweetContext;
-    }
-    const targetPath = resolveDocPath(filename);
-    const cached = getCachedDocument(targetPath);
-    if (cached)
-        return !!cached.metadata?.tweetContext;
-    try {
-        const raw = readFileSync(targetPath, 'utf-8');
-        const { data } = matter(raw);
-        return !!data?.tweetContext;
-    }
-    catch {
-        return false;
-    }
-}
 /** Resolve a docId to a full document target. Fast path for active doc (zero I/O). */
 function resolveDocTarget(docId) {
     const filename = resolveDocId(docId);
@@ -96,24 +79,27 @@ function resolveDocTarget(docId) {
             lastModified: cached.lastModified,
         };
     }
-    // Read from disk
+    // Read from disk — load the MERGED view (canonical body + sidecar overlay).
+    // The bare markdownToTiptap returns canonical-only; without applying the
+    // sidecar, a doc that has pending content (typical after populate_document
+    // or write_to_pad on a non-active doc) would surface here with 0 words and
+    // 0 pending — silently dropping the user's just-written content. The
+    // overlay-aware loader closes that asymmetry. adr: adr/pending-overlay-model.md
     if (!existsSync(filePath))
         throw new Error(`Document file not found: ${filename}`);
-    const raw = readFileSync(filePath, 'utf-8');
-    const parsed = markdownToTiptap(raw);
-    const meta = parsed.metadata || {};
-    const resolvedDocId = meta.docId || docId;
-    const text = extractText(parsed.document.content);
+    const loaded = loadDocFromDisk(filename);
+    const resolvedDocId = loaded.docId || docId;
+    const text = extractText(loaded.document.content);
     return {
         filename,
         filePath,
         docId: resolvedDocId,
         isActive: false,
-        document: parsed.document,
-        title: parsed.title,
-        metadata: parsed.metadata || {},
+        document: loaded.document,
+        title: loaded.title,
+        metadata: loaded.metadata || {},
         wordCount: text.trim() ? text.trim().split(/\s+/).length : 0,
-        pendingCount: countPending(parsed.document.content),
+        pendingCount: countPending(loaded.document.content),
         lastModified: statSync(filePath).mtime,
     };
 }
@@ -302,18 +288,19 @@ export const TOOL_REGISTRY = [
         },
         handler: async ({ changes, docId }) => {
             const filename = resolveDocId(docId);
-            const tweetMode = isTweetDoc(filename);
             const processed = changes.map((change) => {
                 const resolved = { ...change };
                 if (typeof resolved.content === 'string') {
-                    let nodes = parseMarkdownContent(resolved.content);
-                    if (tweetMode)
-                        nodes = mergeParagraphsToHardBreaks(nodes);
-                    resolved.content = nodes;
-                }
-                else if (tweetMode && Array.isArray(resolved.content)) {
-                    resolved.content = mergeParagraphsToHardBreaks(resolved.content);
+                    resolved.content = parseMarkdownContent(resolved.content);
                 }
+                // Tweet docs used to collapse multi-paragraph content into a single
+                // paragraph with hardBreaks (mergeParagraphsToHardBreaks). That made
+                // every multi-paragraph write land as ONE pending-insert decoration
+                // for review, which destroys per-paragraph accept/reject. Each
+                // paragraph the agent writes is a distinct review unit; preserve
+                // that structure. Thread separation (multiple tweets in a thread)
+                // is signaled explicitly by horizontalRule nodes from the agent,
+                // not implied by paragraph count.
                 return resolved;
             });
             // Auto-clean: if doc has only a single empty paragraph and first change is
@@ -566,6 +553,14 @@ export const TOOL_REGISTRY = [
                     broadcastDocumentsChanged();
                     broadcastWorkspacesChanged();
                     broadcastDocumentSwitched(getDocument(), getTitle(), getActiveFilename(), getMetadata());
+                    // Right-rail Activity: one entry per agent-created doc. adr: adr/right-rail.md
+                    broadcastActivityEvent({
+                        kind: 'doc-created',
+                        headline: `Created ${result.title || 'Untitled'}`,
+                        detail: content_type && content_type !== 'document' ? content_type : undefined,
+                        docId: newDocId,
+                        filename: result.filename,
+                    });
                     return {
                         content: [{
                                 type: 'text',
@@ -592,6 +587,14 @@ export const TOOL_REGISTRY = [
                 spinnerKey = result.filename;
                 broadcastWritingStarted(title || 'Untitled', wsTarget, spinnerKey, result.filename, result.docId);
                 broadcastDocumentsChanged();
+                // Right-rail Activity: one entry per agent-created doc. adr: adr/right-rail.md
+                broadcastActivityEvent({
+                    kind: 'doc-created',
+                    headline: `Created ${result.title || 'Untitled'}`,
+                    detail: content_type && content_type !== 'document' ? content_type : undefined,
+                    docId: result.docId,
+                    filename: result.filename,
+                });
                 return {
                     content: [{
                             type: 'text',
@@ -618,14 +621,15 @@ export const TOOL_REGISTRY = [
             try {
                 let doc;
                 if (typeof content === 'string') {
-                    let nodes = parseMarkdownContent(content);
-                    if (isTweetDoc(filename))
-                        nodes = mergeParagraphsToHardBreaks(nodes);
-                    doc = { type: 'doc', content: nodes };
+                    // Don't collapse multi-paragraph content to a single hardBreak-
+                    // separated paragraph for tweet docs. Each paragraph is a
+                    // distinct review unit (its own pending-insert decoration); the
+                    // user accepts/rejects per paragraph. Explicit thread structure
+                    // (multiple tweets in a thread) comes from horizontalRule nodes
+                    // in the agent's input, not from paragraph count.
+                    doc = { type: 'doc', content: parseMarkdownContent(content) };
                 }
                 else if (content?.type === 'doc' && Array.isArray(content.content)) {
-                    if (isTweetDoc(filename))
-                        content.content = mergeParagraphsToHardBreaks(content.content);
                     doc = content;
                 }
                 else {
@@ -656,15 +660,18 @@ export const TOOL_REGISTRY = [
                 if (!isAutoAcceptActive(filename || getActiveFilename(), getMetadata())) {
                     markAllNodesAsPending(doc, 'insert');
                 }
-                // Bug #1 fix (v0.20.0): preserve the stub's trailing canonical paragraph(s).
-                // updateDocument(doc) overwrites state.canonical wholesale — without this
-                // merge, the create_document → populate_document sequence loses the stub's
-                // auto-generated trailing paragraph from canonical. When the browser later
-                // accepts the inserts and sends a doc-update with its TipTap-rendered tree
-                // (which also has a trailing empty paragraph, but a different ID), the
-                // save-time matcher classifies the stub's original trailing as deleted →
-                // graveyard, while the freshly added inserts have no previousNodes match.
-                // Cascading state corruption observed in live test 2026-05-22.
+                // Preserve any pre-existing real content from canonical that the
+                // incoming populate doesn't already cover, so a re-populate doesn't
+                // clobber prior content. updateDocument(doc) overwrites
+                // state.canonical wholesale; without this preserve step, anything
+                // not in `doc.content` after this point disappears.
+                //
+                // Empty paragraphs are explicitly NOT preserved. createDocumentFile
+                // mints a trailing empty paragraph as a TipTap "doc must have at
+                // least one node" stub, and TipTap itself maintains a trailing
+                // empty paragraph for cursor-landing. Preserving those during
+                // populate leaves phantom empty paragraphs accumulating at the
+                // end of the doc. adr: adr/pending-overlay-model.md
                 const existingCanonical = getCanonical();
                 if (existingCanonical?.content?.length) {
                     const incomingIds = new Set(doc.content
@@ -672,7 +679,10 @@ export const TOOL_REGISTRY = [
                         .filter((id) => typeof id === 'string'));
                     const preserved = existingCanonical.content.filter((n) => {
                         const id = n?.attrs?.id;
-                        return id && !incomingIds.has(id);
+                        if (!id || incomingIds.has(id))
+                            return false;
+                        const isEmptyParagraph = n.type === 'paragraph' && (!n.content || n.content.length === 0);
+                        return !isEmptyParagraph;
                     });
                     if (preserved.length > 0) {
                         doc.content = [...doc.content, ...preserved];
@@ -793,6 +803,13 @@ export const TOOL_REGISTRY = [
         },
         handler: async ({ docId }) => {
             const filename = resolveDocId(docId);
+            // Capture title before the file is moved to trash — resolveDocTarget reads
+            // from disk and won't work post-delete.
+            let deletedTitle = filename.replace(/\.md$/, '');
+            try {
+                deletedTitle = resolveDocTarget(docId).title || deletedTitle;
+            }
+            catch { /* fallback to filename */ }
             const result = await deleteDocument(filename);
             removeDocFromAllWorkspaces(filename);
             if (result.switched && result.newDoc) {
@@ -800,6 +817,14 @@ export const TOOL_REGISTRY = [
             }
             broadcastDocumentsChanged();
             broadcastWorkspacesChanged();
+            // Right-rail Activity: one entry per agent-deleted doc. docId is recorded
+            // but the client treats doc-deleted entries as non-clickable. adr: adr/right-rail.md
+            broadcastActivityEvent({
+                kind: 'doc-deleted',
+                headline: `Deleted ${deletedTitle}`,
+                docId,
+                filename,
+            });
             let text = `Deleted "${filename}" (moved to trash)`;
             if (result.switched && result.newDoc) {
                 text += `. Switched to "${result.newDoc.title}"`;
@@ -875,6 +900,20 @@ export const TOOL_REGISTRY = [
             const cleaned = {};
             for (const key of setKeys)
                 cleaned[key] = updates[key];
+            // Title is gated through pending-overlay unless this is a temp file
+            // being titled for the first time (creation path — promoteTempFile
+            // must run synchronously so the file gets a real filename on disk).
+            // adr: adr/pending-overlay-model.md
+            let stagedTitle = null;
+            const isCreationTitleSet = cleaned.title && target.isActive && getIsTemp();
+            const wantsTitlePending = cleaned.title && !isCreationTitleSet;
+            if (wantsTitlePending) {
+                const staged = stagePendingTitle(docId, cleaned.title);
+                if (staged.from !== staged.to) {
+                    stagedTitle = { from: staged.from, to: staged.to };
+                }
+                delete cleaned.title; // remove from the hot-write path
+            }
             if (target.isActive) {
                 // Active doc: use in-memory path
                 if (Object.keys(cleaned).length > 0)
@@ -885,6 +924,7 @@ export const TOOL_REGISTRY = [
                 save();
                 broadcastMetadataChanged(getMetadata());
                 if (cleaned.title) {
+                    // Reached only on temp-file creation titling — hot promote.
                     const promoted = promoteTempFile(cleaned.title);
                     broadcastTitleChanged(cleaned.title);
                     broadcastDocumentsChanged();
@@ -903,14 +943,16 @@ export const TOOL_REGISTRY = [
                 }
                 for (const key of removed)
                     delete meta[key];
-                const newTitle = cleaned.title || meta.title || target.title;
+                // Title may have been stripped out for pending-staging; preserve the
+                // canonical (on-disk) title in the rewrite.
+                const newTitle = meta.title || target.title;
                 const markdown = tiptapToMarkdown(target.document, newTitle, meta);
                 atomicWriteFileSync(target.filePath, markdown);
                 invalidateDocCache(target.filePath);
-                if (cleaned.title) {
-                    updateDocumentTitle(target.filename, cleaned.title);
-                    broadcastDocumentsChanged();
-                }
+            }
+            if (stagedTitle) {
+                broadcastPendingMetadataChanged(docId, { title: stagedTitle });
+                broadcastPendingDocsChanged();
             }
             const keys = Object.keys(cleaned);
             const parts = [];
@@ -986,14 +1028,6 @@ export const TOOL_REGISTRY = [
                         atomicWriteFileSync(target.filePath, markdown);
                         invalidateDocCache(target.filePath);
                     }
-                    // Right-rail Activity: one entry per enriched doc. adr: adr/right-rail.md
-                    broadcastActivityEvent({
-                        kind: 'enrichment',
-                        headline: `Enrichment stamped ${target.title || target.filename}`,
-                        detail: item.logline,
-                        docId: item.docId,
-                        filename: target.filename,
-                    });
                     results.push({ docId: item.docId, ok: true });
                 }
                 catch (err) {
@@ -1007,6 +1041,11 @@ export const TOOL_REGISTRY = [
             const summary = failCount === 0
                 ? `Enriched ${okCount} doc${okCount === 1 ? '' : 's'}`
                 : `Enriched ${okCount} doc${okCount === 1 ? '' : 's'}, ${failCount} failed`;
+            // Right-rail Activity: single summary line for the whole batch. adr: adr/right-rail.md
+            broadcastActivityEvent({
+                kind: 'enrichment',
+                headline: summary,
+            });
             return { content: [{ type: 'text', text: `${summary}\n${JSON.stringify({ docs: results })}` }] };
         },
     },
@@ -1152,9 +1191,24 @@ export const TOOL_REGISTRY = [
             filename: z.string().describe('Workspace manifest filename (e.g. "my-novel-a1b2c3d4.json")'),
         },
         handler: async ({ filename }) => {
+            // Capture workspace title before delete so the activity entry can name it.
+            let wsTitle = filename.replace(/\.json$/, '');
+            try {
+                wsTitle = getWorkspace(filename).title || wsTitle;
+            }
+            catch { /* fallback to filename */ }
             const result = await deleteWorkspace(filename);
             broadcastWorkspacesChanged();
             broadcastDocumentsChanged();
+            // Right-rail Activity: single summary entry for the cascade. Per-doc
+            // entries would flood the log for large workspaces; one entry naming
+            // the workspace + doc count is the better default. adr: adr/right-rail.md
+            const n = result.deletedFiles.length;
+            broadcastActivityEvent({
+                kind: 'doc-deleted',
+                headline: `Deleted workspace ${wsTitle}`,
+                detail: `${n} doc${n === 1 ? '' : 's'}`,
+            });
             let text = `Deleted workspace "${filename}" and ${result.deletedFiles.length} files: ${result.deletedFiles.join(', ')}`;
             if (result.skippedExternal.length > 0) {
                 text += `\nSkipped ${result.skippedExternal.length} external files (not owned by OpenWriter): ${result.skippedExternal.join(', ')}`;
@@ -1405,13 +1459,17 @@ export const TOOL_REGISTRY = [
             if (type === 'document') {
                 if (!docId)
                     return { content: [{ type: 'text', text: 'Error: docId is required for document renames' }] };
-                const resolvedFilename = resolveDocId(docId);
-                updateDocumentTitle(resolvedFilename, newName);
-                broadcastDocumentsChanged();
-                if (resolvedFilename === getActiveFilename()) {
-                    broadcastTitleChanged(newName);
+                // Agent-initiated rename: stage as pending. The user accepts/rejects
+                // via the title-bar inline diff in the browser. The .md file on disk
+                // is NOT modified until accept. adr: adr/pending-overlay-model.md
+                const staged = stagePendingTitle(docId, newName);
+                broadcastPendingMetadataChanged(docId, { title: { from: staged.from, to: staged.to } });
+                // Sidebar / docs list shows a pending indicator for this doc.
+                broadcastPendingDocsChanged();
+                if (staged.from === newName) {
+                    return { content: [{ type: 'text', text: `Document [${docId}] already titled "${newName}" — no change staged.` }] };
                 }
-                return { content: [{ type: 'text', text: `Renamed document [${docId}] to "${newName}"` }] };
+                return { content: [{ type: 'text', text: `Staged title rename for [${docId}]: "${staged.from}" → "${newName}". User will accept or reject in the editor.` }] };
             }
             return { content: [{ type: 'text', text: `Error: unknown type "${type}"` }] };
         },
@@ -2069,6 +2127,30 @@ export const TOOL_REGISTRY = [
 /** Live MCP server instance — used to register plugin tools dynamically. */
 let mcpServerInstance = null;
 /** Convert a JSON Schema properties object to a Zod shape for MCP tool registration. */
+/**
+ * Some MCP clients (notably Claude Code's tool-call serialization for
+ * nested object/array parameters) send JSON-encoded strings instead of
+ * the actual structured value. Wrap object/array schemas with a
+ * preprocess step that opportunistically parses string input as JSON
+ * before validation.
+ */
+function jsonCoerce(inner) {
+    return z.preprocess((val) => {
+        if (typeof val !== 'string')
+            return val;
+        const trimmed = val.trim();
+        if (!trimmed)
+            return val;
+        if (!(trimmed.startsWith('{') || trimmed.startsWith('[')))
+            return val;
+        try {
+            return JSON.parse(trimmed);
+        }
+        catch {
+            return val;
+        }
+    }, inner);
+}
 function jsonSchemaToZodShape(inputSchema) {
     const properties = (inputSchema.properties || {});
     const required = new Set((inputSchema.required || []));
@@ -2082,6 +2164,30 @@ function jsonSchemaToZodShape(inputSchema) {
             case 'boolean':
                 field = z.boolean();
                 break;
+            case 'object':
+                // Pass-through any record-like object. Inner key validation is
+                // the handler's job — keep this loose so plugins can ship typed
+                // shapes through MCP without per-key zod schemas.
+                // Wrap in jsonCoerce so JSON-string-encoded objects are auto-parsed.
+                field = jsonCoerce(z.record(z.string(), z.any()));
+                break;
+            case 'array':
+                // Use items.type for inner validation when provided
+                switch (prop.items?.type) {
+                    case 'string':
+                        field = jsonCoerce(z.array(z.string()));
+                        break;
+                    case 'number':
+                        field = jsonCoerce(z.array(z.number()));
+                        break;
+                    case 'boolean':
+                        field = jsonCoerce(z.array(z.boolean()));
+                        break;
+                    default:
+                        field = jsonCoerce(z.array(z.any()));
+                        break;
+                }
+                break;
             default:
                 field = z.string();
                 break;
@@ -2097,6 +2203,11 @@ function jsonSchemaToZodShape(inputSchema) {
 /** Register MCP tools from plugins. Dynamically adds to the live MCP session. */
 export function registerPluginTools(tools) {
     for (const tool of tools) {
+        // Skip if already in TOOL_REGISTRY (e.g. called twice due to a bug)
+        if (TOOL_REGISTRY.some((t) => t.name === tool.name)) {
+            console.warn(`[PluginManager] registerPluginTools: skipping duplicate tool "${tool.name}"`);
+            continue;
+        }
         const zodShape = jsonSchemaToZodShape(tool.inputSchema);
         const toolDef = {
             name: tool.name,
@@ -2108,9 +2219,17 @@ export function registerPluginTools(tools) {
             },
         };
         TOOL_REGISTRY.push(toolDef);
-        // Register on live MCP server so existing sessions see it immediately
+        // Register on live MCP server so existing sessions see it immediately.
+        // Guard against "already registered" throws — can happen when two plugins
+        // ship a tool with the same name (e.g. an old stale dist vs a new dist).
         if (mcpServerInstance) {
-            mcpServerInstance.tool(tool.name, tool.description, zodShape, toolDef.handler);
+            const registered = mcpServerInstance._registeredTools;
+            if (registered && registered[tool.name]) {
+                console.warn(`[PluginManager] registerPluginTools: skipping MCP-duplicate tool "${tool.name}"`);
+            }
+            else {
+                mcpServerInstance.tool(tool.name, tool.description, zodShape, toolDef.handler);
+            }
         }
     }
     // Notify connected clients that the tool list changed
@@ -2126,7 +2245,25 @@ export function removePluginTools(names) {
             TOOL_REGISTRY.splice(i, 1);
         }
     }
+    // Also remove from the live MCP server's internal registry so re-enable
+    // doesn't hit "Tool already registered". The SDK doesn't expose a public
+    // unregister API — use the registered tool handle's .remove() if available,
+    // otherwise fall back to deleting from _registeredTools directly.
     if (mcpServerInstance) {
+        const registered = mcpServerInstance._registeredTools;
+        if (registered) {
+            for (const name of nameSet) {
+                const handle = registered[name];
+                if (handle) {
+                    if (typeof handle.remove === 'function') {
+                        handle.remove();
+                    }
+                    else {
+                        delete registered[name];
+                    }
+                }
+            }
+        }
         mcpServerInstance.server.sendToolListChanged().catch(() => { });
     }
 }

package/dist/server/pending-metadata.js

@@ -0,0 +1,65 @@
+/**
+ * Pending metadata — sibling of pending-overlay.ts for frontmatter-level
+ * staging. Where the overlay holds proposed BLOCK changes (insert / rewrite
+ * / delete on TipTap nodes), this module holds proposed METADATA changes —
+ * for now just the document title.
+ *
+ * Architectural model:
+ *   - Pending metadata lives in the SAME sidecar file as the block overlay
+ *     (_pending/{docId}.json), under a top-level `metadata:` key. The
+ *     pending-overlay module owns the `entries:` key; this module owns the
+ *     `metadata:` key. Each preserves the other's slot when it writes.
+ *   - The canonical disk .md file's frontmatter is NEVER modified by a
+ *     pending stage — the title only changes on disk after the user accepts.
+ *     Reject discards the proposal; nothing on disk moves.
+ *   - The active document's pending metadata is mirrored into state.ts as
+ *     `state.pendingMetadata` so WS broadcasts and getters expose it without
+ *     a disk read on every poll.
+ *
+ * Why a separate module from pending-overlay.ts:
+ *   - The overlay model is keyed by nodeId and assumes a TipTap tree. Title
+ *     is not in the tree — it's a YAML frontmatter field. Forcing it into a
+ *     fake "node" would corrupt the overlay invariants (nodeId stability,
+ *     splitMergedDoc tree-walk, applyOverlayPure idempotency).
+ *   - Future metadata-staging (tags, status, custom frontmatter fields) lands
+ *     here without further churn to the overlay code path.
+ *
+ * Scope (phase 1): document title only. tag_doc / untag_doc / set_metadata
+ * for non-title fields / mark_enriched still write hot. Workspace and
+ * container renames also still write hot — they live in workspace manifests,
+ * not per-doc sidecars, and need a separate decision.
+ *
+ * adr: adr/pending-overlay-model.md
+ */
+import { readSidecarRaw, writeSidecarRaw } from './pending-overlay.js';
+import { logger } from './logger.js';
+// ============================================================================
+// SIDECAR I/O
+// ============================================================================
+/** Read the pending-metadata slot from the per-doc sidecar. Returns null if
+ *  the sidecar is missing or has no metadata slot. */
+export function loadPendingMetadata(docId) {
+    if (!docId)
+        return null;
+    const raw = readSidecarRaw(docId);
+    if (!raw?.metadata || Object.keys(raw.metadata).length === 0)
+        return null;
+    return raw.metadata;
+}
+/** Persist the pending-metadata slot. Preserves the sidecar's existing
+ *  `entries:` slot. Passing null (or an empty object) clears the metadata
+ *  and may delete the sidecar entirely if entries are also empty. */
+export function savePendingMetadata(docId, meta) {
+    if (!docId)
+        return;
+    const raw = readSidecarRaw(docId);
+    const entries = Array.isArray(raw?.entries) ? raw.entries : [];
+    const cleaned = meta && Object.keys(meta).length > 0 ? meta : null;
+    writeSidecarRaw(docId, { entries, metadata: cleaned || undefined });
+    if (cleaned?.title) {
+        logger.info('overlay', 'meta-stage', `docId=${docId} field=title from="${cleaned.title.from}" to="${cleaned.title.to}"`);
+    }
+    else {
+        logger.info('overlay', 'meta-clear', `docId=${docId}`);
+    }
+}