patchwarden 1.1.0 → 1.5.1

package/src/tools/registry.ts

@@ -1,4 +1,4 @@
-/**
+/**
  * Shared tool registry for PatchWarden MCP server.
  * Used by both stdio (index.ts) and HTTP (httpServer.ts) transports.
  */
@@ -9,57 +9,8 @@ import {
   ListToolsRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
 import { getAllConfiguredTestCommands, getAllConfiguredDirectCommands, getConfig } from "../config.js";
-import { savePlan } from "../tools/savePlan.js";
-import { getPlan } from "../tools/getPlan.js";
-import { createTask } from "../tools/createTask.js";
-import { getTaskStatus } from "../tools/getTaskStatus.js";
-import { getResult, getResultJson, getDiff, getTestLog, getTaskLogTail } from "../tools/taskOutputs.js";
-import { listWorkspace } from "../tools/listWorkspace.js";
-import { readWorkspaceFile } from "../tools/readWorkspaceFile.js";
-import { listTasks } from "../tools/listTasks.js";
-import { cancelTask } from "../tools/cancelTask.js";
-import { killTask } from "../tools/killTask.js";
-import { retryTask } from "../tools/retryTask.js";
-import { getTaskStdoutTail } from "../tools/getTaskStdoutTail.js";
-import { getTaskProgress } from "../tools/getTaskProgress.js";
-import { listAgents } from "../tools/listAgents.js";
-import { healthCheck } from "../tools/healthCheck.js";
-import { getTaskSummary } from "../tools/getTaskSummary.js";
-import { waitForTask } from "../tools/waitForTask.js";
 import { errorPayload, PatchWardenError } from "../errors.js";
-import { auditTask } from "../tools/auditTask.js";
-import { safeStatus } from "../tools/safeStatus.js";
-import {
-  safeAudit,
-  safeAuditDirectSession,
-  safeDiffSummary,
-  safeDirectSummary,
-  safeFinalizeDirectSession,
-  safeResult,
-  safeTestSummary,
-} from "../tools/safeViews.js";
-import { diagnoseTask } from "../tools/diagnoseTask.js";
-import { reconcileTasks } from "../tools/reconcileTasks.js";
-import { discoverTools } from "../tools/discoverTools.js";
-import { explainTool } from "../tools/explainTool.js";
-import { invokeDiscoveredTool } from "./invokeDiscoveredTool.js";
 import { logger } from "../logging.js";
-import { runTask } from "../runner/runTask.js";
-import { createDirectSession } from "../tools/createDirectSession.js";
-import { searchWorkspace } from "../tools/searchWorkspace.js";
-import { applyPatch } from "../tools/applyPatch.js";
-import { runVerification } from "../tools/runVerification.js";
-import { finalizeDirectSession } from "../tools/finalizeDirectSession.js";
-import { auditSession } from "../tools/auditSession.js";
-import { syncFile } from "../tools/syncFile.js";
-import { createGoal, listGoals, readGoal, readGoalStatus } from "../goal/goalStore.js";
-import { suggestNextSubgoal } from "../goal/goalGraph.js";
-import { exportHandoff } from "../goal/handoffExport.js";
-import { acceptSubgoal, rejectSubgoal, summarizeGoalProgress } from "../goal/goalProgress.js";
-import { createSubgoalTask } from "./goalSubgoalTask.js";
-import { checkReleaseGate } from "./checkReleaseGate.js";
-import { mergeWorktreeTool } from "./mergeWorktree.js";
-import { discardWorktreeTool } from "./discardWorktree.js";
 import { TASK_TEMPLATE_NAMES } from "./taskTemplates.js";
 import {
   buildToolCatalogSnapshot,
@@ -68,6 +19,12 @@ import {
   selectToolsForProfile,
   type ToolCatalogSnapshot,
 } from "./toolCatalog.js";
+import { coreHandlers, runTaskHandler } from "./dispatch/coreDispatch.js";
+import { goalHandlers } from "./dispatch/goalDispatch.js";
+import { directHandlers } from "./dispatch/directDispatch.js";
+import { releaseHandlers } from "./dispatch/releaseDispatch.js";
+import { diagnosticHandlers } from "./dispatch/diagnosticDispatch.js";
+import type { ToolHandlerMap } from "./dispatch/types.js";
 
 // ── Tool definitions ──────────────────────────────────────────────
 
@@ -84,10 +41,12 @@ export interface ToolDef {
 export function getToolDefs(): ToolDef[] {
   const config = getConfig();
   const agentNames = Object.keys(config.agents).sort();
+  const routableAgentNames = [...agentNames, "auto"];
   const agentDescription = agentNames.length > 0
-    ? `Configured local agent name. Available agents: ${agentNames.map((name) => JSON.stringify(name)).join(", ")}`
+    ? `Configured local agent name. Available agents: ${agentNames.map((name) => JSON.stringify(name)).join(", ")}. run_task_loop also accepts "auto" for bounded routing.`
     : "Configured local agent name. No agents are currently configured.";
   const testCommands = getAllConfiguredTestCommands(config).sort();
+  const directCommands = getAllConfiguredDirectCommands(config);
   const tools: ToolDef[] = [
     {
       name: "save_plan",
@@ -201,6 +160,178 @@ export function getToolDefs(): ToolDef[] {
         required: [],
       },
     },
+    {
+      name: "run_task_loop",
+      description:
+        "Run a guarded PatchWarden task loop by composing create_task, wait_for_task, safe summaries, and audit_task. It does not bypass the watcher, command allow-list, workspace confinement, or confirmation boundaries. Returns only bounded structured lineage and final status.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          repo_path: {
+            type: "string",
+            description: "Required repository path inside workspaceRoot. No implicit workspace-root fallback is allowed.",
+          },
+          goal: { type: "string", description: "Task goal to execute through the guarded loop." },
+          verify_commands: {
+            type: "array",
+            minItems: 1,
+            maxItems: 20,
+            items: {
+              type: "string",
+              ...(testCommands.length > 0 ? { enum: testCommands } : {}),
+            },
+            description: "Exact-match verification commands. The loop reuses create_task validation and will not run commands outside the allow-list.",
+          },
+          agent: {
+            type: "string",
+            description: agentDescription,
+            ...(agentNames.length > 0 ? { enum: routableAgentNames } : {}),
+          },
+          template: {
+            type: "string",
+            enum: ["inspect_only", "feature_small", "release_check"],
+            default: "feature_small",
+            description: "Initial guarded task template. Follow-up repair tasks use fix_tests automatically when verification fails.",
+          },
+          max_iterations: {
+            type: "integer",
+            minimum: 1,
+            maximum: 5,
+            default: 3,
+            description: "Maximum total main/fix task attempts.",
+          },
+          task_timeout_seconds: {
+            type: "integer",
+            minimum: 1,
+            maximum: config.maxTaskTimeoutSeconds,
+            default: config.defaultTaskTimeoutSeconds,
+            description: `Per-task wait budget in seconds (default ${config.defaultTaskTimeoutSeconds}, max ${config.maxTaskTimeoutSeconds}).`,
+          },
+          auto_fix_tests: {
+            type: "boolean",
+            default: true,
+            description: "When true, create a fix_tests follow-up task after failed_verification until max_iterations is reached.",
+          },
+          auto_cleanup_artifacts: {
+            type: "boolean",
+            default: true,
+            description: "Records cleanup intent in lineage. Low-risk cleanup remains handled by runTask post-task cleanup.",
+          },
+          stop_on_high_risk: {
+            type: "boolean",
+            default: true,
+            description: "When true, stop immediately on non-policy high-risk audit evidence. Scope, policy, sensitive-path, release/publish, and confirmation boundaries always stop regardless of this flag.",
+          },
+          direct_verify: {
+            type: "boolean",
+            default: false,
+            description: "When true, run an independent Direct verification session after the guarded task/audit succeeds. Direct never patches files in this loop.",
+          },
+          direct_verify_commands: {
+            type: "array",
+            minItems: 1,
+            maxItems: 20,
+            items: {
+              type: "string",
+              ...(directCommands.length > 0 ? { enum: directCommands } : {}),
+            },
+            description: "Optional Direct verification commands. Defaults to verify_commands and still must pass the Direct command allow-list.",
+          },
+          direct_verify_timeout_seconds: {
+            type: "integer",
+            minimum: 1,
+            maximum: Math.min(config.maxTaskTimeoutSeconds, config.directSessionTtlSeconds),
+            default: 120,
+            description: "Per-command timeout for Direct verification.",
+          },
+          scope_files: {
+            type: "array",
+            maxItems: 50,
+            items: { type: "string" },
+            description: "Optional bounded file scope used only for agent routing hints.",
+          },
+          isolation_mode: {
+            type: "string",
+            enum: ["current_repo", "worktree"],
+            default: "current_repo",
+            description: "Use current_repo by default. worktree creates an isolated git worktree for the task but never auto-merges it.",
+          },
+          worktree_base_branch: {
+            type: "string",
+            description: "Optional base-branch label recorded in lineage. v1.5 does not auto-checkout or merge this branch.",
+          },
+          worktree_cleanup: {
+            type: "string",
+            enum: ["keep", "archive", "delete_ignored_only"],
+            default: "keep",
+            description: "Cleanup intent recorded in lineage. v1.5 keeps worktrees by default and does not auto-delete them.",
+          },
+        },
+        required: ["repo_path", "goal", "verify_commands"],
+      },
+    },
+    {
+      name: "recommend_agent_for_task",
+      description:
+        "Return a bounded read-only agent routing recommendation for a repo-scoped task. Does not start an agent, create a task, or read logs.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          repo_path: { type: "string", description: "Repository path inside workspaceRoot." },
+          goal: { type: "string", description: "Task goal used for routing hints." },
+          scope_files: {
+            type: "array",
+            maxItems: 50,
+            items: { type: "string" },
+            description: "Optional bounded list of files or directories expected to be in scope.",
+          },
+          template: { type: "string", description: "Optional task template hint." },
+          risk_hint: { type: "string", description: "Optional compact risk hint text." },
+        },
+        required: ["repo_path", "goal"],
+      },
+    },
+    {
+      name: "get_task_lineage",
+      description:
+        "Read a bounded safe summary for a run_task_loop lineage. Does not return full logs, diffs, stdout, stderr, or markdown artifacts.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          lineage_id: { type: "string", description: "Lineage ID returned by run_task_loop." },
+          max_items: { type: "integer", minimum: 1, maximum: 50, default: 8, description: "Maximum rounds/tasks/warnings to return." },
+        },
+        required: ["lineage_id"],
+      },
+    },
+    {
+      name: "export_task_evidence_pack",
+      description:
+        "Export a bounded evidence pack for a run_task_loop lineage. Writes evidence.json and EVIDENCE.md without stdout, stderr, full logs, full diff, or sensitive file contents.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          lineage_id: { type: "string", description: "Lineage ID returned by run_task_loop." },
+          max_items: { type: "integer", minimum: 1, maximum: 50, default: 12, description: "Maximum rounds/tasks/warnings to include." },
+        },
+        required: ["lineage_id"],
+      },
+    },
+    {
+      name: "get_project_policy",
+      description:
+        "Read the bounded effective .patchwarden/project-policy.json summary for a repository. Missing policy returns safe defaults. Project policy never expands PatchWarden command allow-lists, workspace confinement, sensitive-path blocking, or watcher/audit boundaries.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          repo_path: {
+            type: "string",
+            description: "Repository path inside workspaceRoot.",
+          },
+        },
+        required: ["repo_path"],
+      },
+    },
     {
       name: "get_task_status",
       description: "Check task status, execution phase, watcher health, pending reason, current command, timeout, and change evidence.",
@@ -768,6 +899,29 @@ export function getToolDefs(): ToolDef[] {
         required: ["goal_id"],
       },
     },
+    {
+      name: "export_goal_report",
+      description: "Export a structured final report for a Goal session, aggregating subgoal completion, task evidence, and risk summary.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          goal_id: { type: "string", description: "The goal id to export report for." },
+        },
+        required: ["goal_id"],
+      },
+    },
+    {
+      name: "import_speckit_tasks",
+      description: "Import Spec Kit tasks into a Goal session as subgoals, mapping task files to scope hints and acceptance criteria.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          goal_id: { type: "string", description: "The goal id to import tasks into." },
+          spec_kit_json: { type: "string", description: "Spec Kit JSON text containing spec, tasks[], and acceptance[] fields." },
+        },
+        required: ["goal_id", "spec_kit_json"],
+      },
+    },
     {
       name: "check_release_gate",
       description:
@@ -789,6 +943,91 @@ export function getToolDefs(): ToolDef[] {
         required: ["repo_path", "target_stage"],
       },
     },
+    {
+      name: "release_check",
+      description:
+        "v1.3.0: Run a bounded release readiness check by wrapping the existing release gate. Local stages use existing guarded release-gate commands; remote stages are read-only. Does not publish, push, tag, or create a GitHub Release.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          repo_path: { type: "string", description: "Repository path inside workspaceRoot." },
+          target_stage: {
+            type: "string",
+            enum: ["local_ready", "packed_ready", "published_verified", "github_release_verified", "ci_verified"],
+            default: "local_ready",
+            description: "Release gate stage to check. Defaults to local_ready.",
+          },
+          package_name: { type: "string", description: "npm package name for remote verification." },
+          version: { type: "string", description: "Version to verify. Defaults to project policy/package.json when omitted." },
+          github_repo: { type: "string", description: "GitHub repo in owner/repo form for release/CI verification." },
+          branch: { type: "string", default: "main", description: "Branch for CI verification." },
+        },
+        required: ["repo_path"],
+      },
+    },
+    {
+      name: "release_prepare",
+      description:
+        "v1.3.0: Run project-policy release preparation commands only when each command is already accepted by the existing PatchWarden command guard. Returns command status only, never stdout/stderr. Does not publish, push, tag, or create a GitHub Release.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          repo_path: { type: "string", description: "Repository path inside workspaceRoot." },
+          required_commands: {
+            type: "array",
+            maxItems: 10,
+            items: {
+              type: "string",
+              ...(testCommands.length > 0 ? { enum: testCommands } : {}),
+            },
+            description: "Optional exact-match release preparation commands. Defaults to project policy release_mode.required_commands.",
+          },
+          timeout_seconds: {
+            type: "integer",
+            minimum: 1,
+            maximum: config.maxTaskTimeoutSeconds,
+            default: 300,
+            description: "Per-command timeout in seconds.",
+          },
+        },
+        required: ["repo_path"],
+      },
+    },
+    {
+      name: "release_verify",
+      description:
+        "v1.3.0: Verify npm/GitHub/CI release facts with read-only HTTPS requests. Does not run local shell commands and does not publish, push, tag, or create a GitHub Release.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          repo_path: { type: "string", description: "Repository path inside workspaceRoot." },
+          package_name: { type: "string", description: "npm package name. Defaults to package.json name." },
+          version: { type: "string", description: "Version to verify. Defaults to project policy/package.json." },
+          github_repo: { type: "string", description: "GitHub repo in owner/repo form. Defaults to package.json repository when available." },
+          branch: { type: "string", default: "main", description: "Branch for CI verification." },
+        },
+        required: ["repo_path"],
+      },
+    },
+    {
+      name: "release_cleanup",
+      description:
+        "v1.3.0: Clean up release artifacts using project-policy auto_cleanup rules. Defaults to dry_run=true. Non-dry-run cleanup only removes low-risk ignored/untracked artifacts under repo_path and writes an audit summary.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          repo_path: { type: "string", description: "Repository path inside workspaceRoot." },
+          dry_run: { type: "boolean", default: true, description: "Preview cleanup by default. Set false to remove eligible artifacts." },
+          patterns: {
+            type: "array",
+            maxItems: 20,
+            items: { type: "string" },
+            description: "Optional cleanup patterns. Defaults to project policy auto_cleanup.patterns.",
+          },
+        },
+        required: ["repo_path"],
+      },
+    },
     {
       name: "merge_worktree",
       description:
@@ -818,7 +1057,6 @@ export function getToolDefs(): ToolDef[] {
   ];
 
   // Direct session tools
-  const directCommands = getAllConfiguredDirectCommands(config);
   tools.push({
     name: "create_direct_session",
     description:
@@ -908,6 +1146,30 @@ export function getToolDefs(): ToolDef[] {
     },
   });
 
+  tools.push({
+    name: "run_direct_verification_bundle",
+    description:
+      "Run multiple allowlisted Direct verification commands sequentially and return only bounded structured status. Omits stdout/stderr tails and log content.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        session_id: { type: "string", description: "Direct session ID" },
+        commands: {
+          type: "array",
+          minItems: 1,
+          maxItems: 20,
+          items: {
+            type: "string",
+            ...(directCommands.length > 0 ? { enum: directCommands } : {}),
+          },
+          description: "Verification commands to run in order. Each command must be accepted by the existing Direct command guard.",
+        },
+        timeout_seconds: { type: "integer", minimum: 1, maximum: Math.min(config.maxTaskTimeoutSeconds, config.directSessionTtlSeconds), default: 120 },
+      },
+      required: ["session_id", "commands"],
+    },
+  });
+
   tools.push({
     name: "finalize_direct_session",
     description:
@@ -993,7 +1255,7 @@ export function getToolDefs(): ToolDef[] {
   });
 
   // run_task: only available when explicitly enabled
-  if ((config as any).enableRunTaskTool === true) {
+  if (config.enableRunTaskTool === true) {
     tools.push({
       name: "run_task",
       description:
@@ -1020,21 +1282,32 @@ export function getToolCatalogSnapshot(): ToolCatalogSnapshot {
   return buildToolCatalogSnapshot(tools, resolveToolProfile(config.toolProfile));
 }
 
-// ── Request handler ───────────────────────────────────────────────
+// ── Dispatch map ─────────────────────────────────────────────────
 
-function guardDirectProfileEnabled(): void {
+/**
+ * Combined dispatch map assembled from all domain handler maps.
+ * run_task is conditionally added when enableRunTaskTool is true,
+ * mirroring the conditional registration in getToolDefs().
+ */
+function buildDispatchMap(): ToolHandlerMap {
   const config = getConfig();
-  if (!config.enableDirectProfile) {
-    throw new PatchWardenError(
-      "direct_profile_disabled",
-      "Direct profile is disabled by local config.",
-      "Set enableDirectProfile: true in patchwarden.config.json to use Direct session tools.",
-      true,
-      { operation: "direct_tool_call" }
-    );
+  const map: ToolHandlerMap = {
+    ...coreHandlers,
+    ...goalHandlers,
+    ...directHandlers,
+    ...releaseHandlers,
+    ...diagnosticHandlers,
+  };
+  if (config.enableRunTaskTool === true) {
+    map.run_task = runTaskHandler;
   }
+  return map;
 }
 
+const dispatchMap: ToolHandlerMap = buildDispatchMap();
+
+// ── Request handler ───────────────────────────────────────────────
+
 export async function handleToolCall(name: string, args: Record<string, unknown> | undefined) {
   const startTime = Date.now();
   const taskId = args?.task_id ? String(args.task_id) : args?.session_id ? String(args.session_id) : undefined;
@@ -1050,453 +1323,11 @@ export async function handleToolCall(name: string, args: Record<string, unknown>
 }
 
 async function handleToolCallInternal(name: string, args: Record<string, unknown> | undefined) {
-  switch (name) {
-    case "save_plan": {
-      return toResult(
-        savePlan({
-          title: String(args?.title ?? ""),
-          content: args?.content !== undefined ? String(args.content) : "",
-          plan_ref: args?.plan_ref ? String(args.plan_ref) : undefined,
-        })
-      );
-    }
-
-    case "get_plan": {
-      return toResult(
-        getPlan({ plan_id: String(args?.plan_id ?? "") })
-      );
-    }
-
-    case "create_task": {
-      return toResult(
-        createTask({
-          plan_id: args?.plan_id ? String(args.plan_id) : undefined,
-          inline_plan: args?.inline_plan ? String(args.inline_plan) : undefined,
-          plan_title: args?.plan_title ? String(args.plan_title) : undefined,
-          template: args?.template ? String(args.template) as any : undefined,
-          goal: args?.goal ? String(args.goal) : undefined,
-          source_task_id: args?.source_task_id ? String(args.source_task_id) : undefined,
-          agent: String(args?.agent ?? ""),
-          repo_path: args?.repo_path ? String(args.repo_path) : undefined,
-          test_command: args?.test_command ? String(args.test_command) : undefined,
-          verify_commands: Array.isArray(args?.verify_commands)
-            ? args.verify_commands.map((command) => String(command))
-            : undefined,
-          timeout_seconds: args?.timeout_seconds !== undefined
-            ? Number(args.timeout_seconds)
-            : undefined,
-          execution_mode: args?.execution_mode === "assess_only" ? "assess_only" : "execute",
-          assessment_id: args?.assessment_id ? String(args.assessment_id) : undefined,
-        })
-      );
-    }
-
-    case "get_task_status": {
-      return toResult(getTaskStatus(String(args?.task_id ?? "")));
-    }
-
-    case "get_result": {
-      return toResult(getResult(String(args?.task_id ?? "")));
-    }
-
-    case "get_result_json": {
-      return toResult(getResultJson(String(args?.task_id ?? "")));
-    }
-
-    case "get_diff": {
-      return toResult(getDiff(String(args?.task_id ?? "")));
-    }
-
-    case "get_test_log": {
-      return toResult(getTestLog(String(args?.task_id ?? "")));
-    }
-
-    case "list_workspace": {
-      return toResult(
-        listWorkspace(args?.path ? String(args.path) : undefined)
-      );
-    }
-
-    case "read_workspace_file": {
-      const sessionId = args?.session_id ? String(args.session_id) : undefined;
-      return toResult(readWorkspaceFile({
-        path: String(args?.path ?? ""),
-        session_id: sessionId,
-      }));
-    }
-
-    case "list_tasks": {
-      return toResult(listTasks({
-        status: args?.status ? String(args.status) : undefined,
-        repo_path: args?.repo_path ? String(args.repo_path) : undefined,
-        active_only: args?.active_only !== undefined ? Boolean(args.active_only) : undefined,
-        limit: args?.limit ? Number(args.limit) : undefined,
-      }));
-    }
-
-    case "list_agents": {
-      return toResult(listAgents());
-    }
-
-    case "health_check": {
-      return toResult(healthCheck(getToolCatalogSnapshot(), {
-        detail: args?.detail === "self_diagnostic" ? "self_diagnostic" : "standard",
-      }));
-    }
-
-    case "cancel_task": {
-      return toResult(cancelTask(String(args?.task_id ?? "")));
-    }
-
-    case "kill_task": {
-      return toResult(killTask(String(args?.task_id ?? "")));
-    }
-
-    case "retry_task": {
-      return toResult(retryTask(String(args?.task_id ?? "")));
-    }
-
-    case "get_task_stdout_tail": {
-      return toResult(getTaskStdoutTail(
-        String(args?.task_id ?? ""),
-        args?.lines ? Number(args.lines) : undefined
-      ));
-    }
-
-    case "get_task_log_tail": {
-      return toResult(getTaskLogTail(
-        String(args?.task_id ?? ""),
-        (args?.file as "stdout" | "stderr" | "test" | "verify") || "stdout",
-        {
-          lines: args?.lines ? Number(args.lines) : undefined,
-          redact: args?.redact !== undefined ? Boolean(args.redact) : undefined,
-        }
-      ));
-    }
-
-    case "get_task_progress": {
-      return toResult(getTaskProgress(String(args?.task_id ?? "")));
-    }
-
-    case "wait_for_task": {
-      const waitSeconds = normalizeWaitSeconds(args);
-      return toResult(await waitForTask(
-        String(args?.task_id ?? ""),
-        waitSeconds
-      ));
-    }
-
-    case "get_task_summary": {
-      return toResult(getTaskSummary(String(args?.task_id ?? ""), {
-        view: normalizeSummaryView(args?.view),
-        max_items: args?.max_items !== undefined ? Number(args.max_items) : undefined,
-      }));
-    }
-
-    case "audit_task": {
-      return toResult(auditTask(String(args?.task_id ?? "")));
-    }
-
-    case "safe_status": {
-      return toResult(safeStatus(String(args?.task_id ?? "")));
-    }
-
-    case "safe_result": {
-      return toResult(safeResult(String(args?.task_id ?? ""), {
-        max_items: args?.max_items !== undefined ? Number(args.max_items) : undefined,
-      }));
-    }
-
-    case "safe_audit": {
-      return toResult(safeAudit(String(args?.task_id ?? ""), {
-        max_items: args?.max_items !== undefined ? Number(args.max_items) : undefined,
-      }));
-    }
-
-    case "safe_test_summary": {
-      return toResult(safeTestSummary(String(args?.task_id ?? "")));
-    }
-
-    case "safe_diff_summary": {
-      return toResult(safeDiffSummary(String(args?.task_id ?? ""), {
-        max_items: args?.max_items !== undefined ? Number(args.max_items) : undefined,
-      }));
-    }
-    case "diagnose_task": {
-      return toResult(diagnoseTask({
-        task_id: String(args?.task_id ?? ""),
-        include_logs: args?.include_logs !== undefined ? Boolean(args.include_logs) : undefined,
-      }));
-    }
-
-    case "reconcile_tasks": {
-      return toResult(reconcileTasks({
-        mode: args?.mode === "safe_fix" ? "safe_fix" : "report_only",
-        max_age_minutes: args?.max_age_minutes !== undefined ? Number(args.max_age_minutes) : undefined,
-        include_done_candidates: args?.include_done_candidates !== undefined ? Boolean(args.include_done_candidates) : undefined,
-      }));
-    }
-
-    case "discover_tools": {
-      const profile = args?.profile === "full" || args?.profile === "chatgpt_core" || args?.profile === "chatgpt_direct" || args?.profile === "chatgpt_search"
-        ? args.profile : undefined;
-      const mode = args?.mode === "delegate" || args?.mode === "direct" || args?.mode === "audit" || args?.mode === "release" || args?.mode === "diagnostic"
-        ? args.mode : undefined;
-      const riskCeiling = ["readonly", "workspace_read_sensitive", "workspace_write", "command", "release", "credential_sensitive"]
-        .includes(String(args?.riskCeiling ?? "")) ? String(args?.riskCeiling) as any : undefined;
-      return toResult(discoverTools({
-        query: String(args?.query ?? ""),
-        profile,
-        mode,
-        maxResults: args?.maxResults !== undefined ? Number(args.maxResults) : undefined,
-        riskCeiling,
-        includeHighRisk: args?.includeHighRisk !== undefined ? Boolean(args.includeHighRisk) : undefined,
-      }, getToolDefs()));
-    }
-
-    case "explain_tool": {
-      return toResult(explainTool({
-        name: String(args?.name ?? ""),
-        includeSchema: args?.includeSchema !== undefined ? Boolean(args.includeSchema) : undefined,
-      }, getToolDefs()));
-    }
-
-    case "invoke_discovered_tool": {
-      const profile = resolveToolProfile(getConfig().toolProfile);
-      const result = await invokeDiscoveredTool({
-        toolName: String(args?.toolName ?? ""),
-        arguments: (args?.arguments && typeof args.arguments === "object" ? args.arguments : {}) as Record<string, unknown>,
-        discoveryToken: String(args?.discoveryToken ?? ""),
-        assessmentId: args?.assessmentId ? String(args.assessmentId) : undefined,
-      }, {
-        tools: getToolDefs(),
-        profile,
-        dispatch: async (name, dispatchArgs) => {
-          return handleToolCall(name, dispatchArgs);
-        },
-      });
-      return toResult(result);
-    }
-
-    case "run_task": {
-      const config = getConfig();
-      if ((config as any).enableRunTaskTool !== true) {
-        throw new Error(
-          "run_task is disabled. Set enableRunTaskTool: true in config to enable. Prefer using the local watcher (npm run watch)."
-        );
-      }
-      const taskId = String(args?.task_id ?? "");
-      const result = await runTask(taskId);
-      return toResult(result);
-    }
-
-    case "create_direct_session": {
-      guardDirectProfileEnabled();
-      return toResult(createDirectSession({
-        repo_path: String(args?.repo_path ?? ""),
-        title: args?.title ? String(args.title) : undefined,
-      }));
-    }
-
-    case "search_workspace": {
-      guardDirectProfileEnabled();
-      return toResult(searchWorkspace({
-        session_id: String(args?.session_id ?? ""),
-        query: String(args?.query ?? ""),
-        max_results: args?.max_results ? Number(args.max_results) : undefined,
-        case_sensitive: args?.case_sensitive !== undefined ? Boolean(args.case_sensitive) : undefined,
-        max_preview_chars: args?.max_preview_chars ? Number(args.max_preview_chars) : undefined,
-        include_globs: Array.isArray(args?.include_globs) ? args.include_globs.map(String) : undefined,
-      }));
-    }
-
-    case "apply_patch": {
-      guardDirectProfileEnabled();
-      return toResult(applyPatch({
-        session_id: String(args?.session_id ?? ""),
-        path: String(args?.path ?? ""),
-        expected_sha256: String(args?.expected_sha256 ?? ""),
-        operations: Array.isArray(args?.operations) ? args.operations as any : [],
-      }));
-    }
-
-    case "run_verification": {
-      guardDirectProfileEnabled();
-      return toResult(await runVerification({
-        session_id: String(args?.session_id ?? ""),
-        command: String(args?.command ?? ""),
-        timeout_seconds: args?.timeout_seconds ? Number(args.timeout_seconds) : undefined,
-      }));
-    }
-
-    case "finalize_direct_session": {
-      guardDirectProfileEnabled();
-      return toResult(finalizeDirectSession({
-        session_id: String(args?.session_id ?? ""),
-      }));
-    }
-
-    case "audit_session": {
-      guardDirectProfileEnabled();
-      return toResult(auditSession({
-        session_id: String(args?.session_id ?? ""),
-      }));
-    }
-
-    case "safe_direct_summary": {
-      guardDirectProfileEnabled();
-      return toResult(safeDirectSummary(String(args?.session_id ?? ""), {
-        max_items: args?.max_items !== undefined ? Number(args.max_items) : undefined,
-      }));
-    }
-
-    case "safe_finalize_direct_session": {
-      guardDirectProfileEnabled();
-      return toResult(safeFinalizeDirectSession(String(args?.session_id ?? ""), {
-        max_items: args?.max_items !== undefined ? Number(args.max_items) : undefined,
-      }));
-    }
-
-    case "safe_audit_direct_session": {
-      guardDirectProfileEnabled();
-      return toResult(safeAuditDirectSession(String(args?.session_id ?? ""), {
-        max_items: args?.max_items !== undefined ? Number(args.max_items) : undefined,
-      }));
-    }
-    case "sync_file": {
-      guardDirectProfileEnabled();
-      return toResult(syncFile(
-        String(args?.session_id ?? ""),
-        String(args?.source_path ?? ""),
-        String(args?.target_path ?? ""),
-        {
-          expected_source_sha256: args?.expected_source_sha256 ? String(args.expected_source_sha256) : undefined,
-          expected_target_sha256: args?.expected_target_sha256 ? String(args.expected_target_sha256) : undefined,
-        }
-      ));
-    }
-
-    case "create_goal": {
-      return toResult(createGoal(
-        String(args?.repo_path ?? ""),
-        String(args?.title ?? ""),
-        String(args?.goal_description ?? "")
-      ));
-    }
-
-    case "list_goals": {
-      return toResult({ goals: listGoals() });
-    }
-
-    case "read_goal": {
-      return toResult(readGoal(String(args?.goal_id ?? "")));
-    }
-
-    case "create_subgoal_task": {
-      return toResult(createSubgoalTask({
-        goal_id: String(args?.goal_id ?? ""),
-        subgoal_title: String(args?.subgoal_title ?? ""),
-        depends_on: Array.isArray(args?.depends_on) ? args.depends_on.map(String) : undefined,
-        plan_id: args?.plan_id ? String(args.plan_id) : undefined,
-        inline_plan: args?.inline_plan ? String(args.inline_plan) : undefined,
-        plan_title: args?.plan_title ? String(args.plan_title) : undefined,
-        template: args?.template ? String(args.template) as any : undefined,
-        goal: args?.goal ? String(args.goal) : undefined,
-        agent: args?.agent ? String(args.agent) : undefined,
-        repo_path: String(args?.repo_path ?? ""),
-        test_command: args?.test_command ? String(args.test_command) : undefined,
-        verify_commands: Array.isArray(args?.verify_commands) ? args.verify_commands.map(String) : undefined,
-        timeout_seconds: args?.timeout_seconds ? Number(args.timeout_seconds) : undefined,
-        scope: Array.isArray(args?.scope) ? args.scope.map(String) : undefined,
-        forbidden: Array.isArray(args?.forbidden) ? args.forbidden.map(String) : undefined,
-        verification: Array.isArray(args?.verification) ? args.verification.map(String) : undefined,
-        done_evidence: Array.isArray(args?.done_evidence) ? args.done_evidence.map(String) : undefined,
-        isolate_worktree: args?.isolate_worktree === undefined ? undefined : Boolean(args.isolate_worktree),
-      }));
-    }
-
-    case "accept_subgoal": {
-      return toResult(acceptSubgoal(
-        String(args?.goal_id ?? ""),
-        String(args?.subgoal_id ?? "")
-      ));
-    }
-
-    case "reject_subgoal": {
-      return toResult(rejectSubgoal(
-        String(args?.goal_id ?? ""),
-        String(args?.subgoal_id ?? ""),
-        String(args?.reason ?? "")
-      ));
-    }
-
-    case "suggest_next_subgoal": {
-      const goalStatus = readGoalStatus(String(args?.goal_id ?? ""));
-      return toResult(suggestNextSubgoal(goalStatus));
-    }
-
-    case "summarize_goal_progress": {
-      return toResult(summarizeGoalProgress(String(args?.goal_id ?? "")));
-    }
-
-    case "export_handoff": {
-      const goalId = String(args?.goal_id ?? "");
-      const goalStatus = readGoalStatus(goalId);
-      return toResult(exportHandoff(goalId, goalStatus));
-    }
-
-    case "check_release_gate": {
-      return toResult(await checkReleaseGate({
-        repo_path: String(args?.repo_path ?? ""),
-        target_stage: String(args?.target_stage ?? "local_ready") as any,
-        package_name: args?.package_name ? String(args.package_name) : undefined,
-        version: args?.version ? String(args.version) : undefined,
-        github_repo: args?.github_repo ? String(args.github_repo) : undefined,
-        branch: args?.branch ? String(args.branch) : undefined,
-      }));
-    }
-
-    case "merge_worktree": {
-      return toResult(mergeWorktreeTool({
-        worktree_id: String(args?.worktree_id ?? ""),
-        repo_path: String(args?.repo_path ?? ""),
-      }));
-    }
-
-    case "discard_worktree": {
-      return toResult(discardWorktreeTool({
-        worktree_id: String(args?.worktree_id ?? ""),
-        repo_path: String(args?.repo_path ?? ""),
-      }));
-    }
-
-    default:
-      throw new Error(`Unknown tool: ${name}`);
-  }
-}
-
-function normalizeWaitSeconds(args: Record<string, unknown> | undefined): number | undefined {
-  const legacy = args?.wait_seconds;
-  const preferred = args?.timeout_seconds;
-  if (legacy !== undefined && preferred !== undefined && Number(legacy) !== Number(preferred)) {
-    throw new Error("wait_seconds and timeout_seconds must match when both are supplied.");
+  const handler = dispatchMap[name];
+  if (!handler) {
+    throw new Error(`Unknown tool: ${name}`);
   }
-  const value = preferred ?? legacy;
-  return value === undefined ? undefined : Number(value);
-}
-
-function normalizeSummaryView(value: unknown): "compact" | "standard" {
-  if (value === undefined) return "standard";
-  if (value !== "compact" && value !== "standard") {
-    throw new Error('view must be "compact" or "standard".');
-  }
-  return value;
-}
-
-function toResult(data: unknown) {
-  return {
-    content: [{ type: "text" as const, text: JSON.stringify(data, null, 2) }],
-  };
+  return handler(args);
 }
 
 // ── Register on MCP Server ────────────────────────────────────────
@@ -1508,6 +1339,18 @@ export function registerTools(server: Server) {
   const activeTools = getToolDefs();
   const activeNames = new Set(activeTools.map((tool) => tool.name));
 
+  // Verify every registered tool has a dispatch handler.
+  // The dispatch map may contain extra handlers for tools exposed under
+  // other profiles (e.g. get_plan is only in the "full" profile), so we
+  // only check the subset direction: every active tool must have a handler.
+  for (const tool of activeTools) {
+    if (!dispatchMap[tool.name]) {
+      throw new Error(
+        `Dispatch map is missing handler for registered tool "${tool.name}".`,
+      );
+    }
+  }
+
   server.setRequestHandler(ListToolsRequestSchema, async () => {
     const catalog = getLastToolCatalogSnapshot();
     return {