renor-engine 0.0.0-stage → 1.0.0

package/dist/indexer/staleness.js

@@ -0,0 +1,201 @@
+"use strict";
+// Vault-staleness guard (D1). The production indexer once served a vault
+// checkout that was 330 commits / 12 days stale and nothing alarmed — the fix
+// is to make staleness a loud, machine-readable signal at startup instead of a
+// silent property of a mis-configured VAULT_PATH.
+//
+// LOCAL-ONLY by design: this module never runs `git fetch` or any network call.
+// It compares HEAD against the ALREADY-FETCHED upstream ref (refs/remotes/*)
+// and HEAD's own commit age. A stale *fetch* is a deployment concern (a cron
+// `git fetch` upstream); a stale *index* at read time is the failure D1
+// shipped, and both signals catch that class.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkVaultStaleness = checkVaultStaleness;
+exports.stalenessMode = stalenessMode;
+exports.stalenessArmed = stalenessArmed;
+exports.stalenessJsonField = stalenessJsonField;
+exports.stalenessGate = stalenessGate;
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const DAY_MS = 24 * 60 * 60 * 1000;
+function git(cwd, args) {
+    try {
+        return (0, child_process_1.execFileSync)('git', args, { cwd, stdio: ['ignore', 'pipe', 'ignore'] })
+            .toString()
+            .trim();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the upstream ref of the current branch WITHOUT any network I/O:
+ * branch.<name>.remote + branch.<name>.merge → refs/remotes/<remote>/<branch>.
+ * Detached HEAD or no upstream → null (age signal still applies).
+ */
+function upstreamRef(cwd) {
+    const branch = git(cwd, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    if (!branch || branch === 'HEAD')
+        return null;
+    const remote = git(cwd, ['config', '--get', `branch.${branch}.remote`]);
+    const merge = git(cwd, ['config', '--get', `branch.${branch}.merge`]);
+    if (!remote || !merge)
+        return null;
+    const ref = merge.replace('refs/heads/', `refs/remotes/${remote}/`);
+    // The ref must EXIST locally (fetched at some point). A ref that only
+    // exists on the remote is invisible here — that is by design.
+    if (!git(cwd, ['rev-parse', '--verify', '--quiet', ref]))
+        return null;
+    return ref;
+}
+/**
+ * Evaluate vault staleness for the directory the indexer is about to serve.
+ * Zero model calls, zero network. Pure filesystem + local git metadata.
+ */
+function checkVaultStaleness(vaultPath, opts = {}) {
+    const maxHeadAgeDays = opts.maxHeadAgeDays ?? 3;
+    // WHICH checkout is this verdict about? The vault path itself when it is a work-tree root
+    // (`vaultPath/.git` exists — a directory, or a file for a linked worktree or submodule),
+    // otherwise the ENCLOSING work tree that contains it. A vault that is a subdirectory of a
+    // project repo is an ordinary layout, and answering "plain, never alarm" for it would
+    // silently serve exactly the stale checkout this guard exists to catch: measured on a
+    // 28-day-old repository, its root reported stale while `<root>/notes` reported
+    // `{stale:false, kind:'plain'}`.
+    //
+    // A nested vault is judged by the SAME checkout-level signals as a root one — behind the
+    // already-fetched upstream ref, and HEAD commit age — so two vaults inside one repository
+    // cannot mean two different things.
+    //
+    // The enclosing root is often the PLATFORM repository, and that is stated here rather than
+    // rediscovered: `engine/` is a subtree of the platform repo, so `git rev-parse
+    // --show-toplevel` run from inside `engine/` returns the platform root — which is exactly why
+    // `engine/scripts/ci/local.sh` (lines 25-28) and `engine/scripts/eval/run-cycle.sh`
+    // (lines 3-6) resolve their own root from `$0` instead of asking git. So a vault under this
+    // checkout is judged against the platform checkout, and `repoRoot` records that.
+    const isWorkTreeRoot = fs_1.default.existsSync(path_1.default.join(vaultPath, '.git'));
+    const repoRoot = isWorkTreeRoot ? vaultPath : git(vaultPath, ['rev-parse', '--show-toplevel']);
+    if (!repoRoot) {
+        // In no work tree at all: nothing to judge, never alarm on a plain folder.
+        return { stale: false, reasons: [], kind: 'plain' };
+    }
+    const reasons = [];
+    const out = { stale: false, reasons: [], kind: 'git', repoRoot };
+    // A nested vault is judged against the ENCLOSING checkout, so every reason it produces names
+    // that root: a refusal whose banner read only "HEAD is 3 commit(s) behind" would not tell the
+    // operator WHICH repository is behind, and `fatal` exits before anything else is printed.
+    const scope = repoRoot === vaultPath ? '' : ` (enclosing checkout ${repoRoot})`;
+    const head = git(repoRoot, ['rev-parse', 'HEAD']);
+    out.head = head ?? undefined;
+    if (!head)
+        return out; // unreadable repo — do not guess, do not alarm
+    const upstream = upstreamRef(repoRoot);
+    out.upstream = upstream;
+    if (upstream) {
+        const aheadBehind = git(repoRoot, ['rev-list', '--left-right', '--count', `${upstream}...${head}`]);
+        if (aheadBehind) {
+            const [behindStr] = aheadBehind.split(/\s+/);
+            const behind = parseInt(behindStr, 10);
+            out.behind = behind;
+            if (behind > 0) {
+                reasons.push(`HEAD is ${behind} commit(s) behind local upstream ref ${upstream}${scope}`);
+            }
+        }
+    }
+    const ts = git(repoRoot, ['log', '-1', '--format=%ct', 'HEAD']);
+    if (ts) {
+        const ageDays = Math.max(0, (Date.now() - parseInt(ts, 10) * 1000) / DAY_MS);
+        out.headAgeDays = Math.round(ageDays * 10) / 10;
+        if (ageDays > maxHeadAgeDays) {
+            reasons.push(`HEAD commit is ${out.headAgeDays}d old (>${maxHeadAgeDays}d) — the checkout may not be receiving updates${scope}`);
+        }
+    }
+    out.stale = reasons.length > 0;
+    out.reasons = reasons;
+    return out;
+}
+/** RENOR_VAULT_STALENESS=off|warn|fatal (default warn; empty/unset = warn). */
+function stalenessMode() {
+    const raw = (process.env.RENOR_VAULT_STALENESS ?? '').trim().toLowerCase();
+    if (raw === 'off' || raw === 'warn' || raw === 'fatal')
+        return raw;
+    return 'warn';
+}
+/**
+ * Is the guard EXPLICITLY armed?
+ *
+ * `RENOR_VAULT_STALENESS` unset means "the operator asked for nothing", which is not the
+ * same as asking for `warn`: `stalenessMode()` defaults to `warn` so the startup banner is
+ * loud by default, but a default the operator never typed must never change a response
+ * shape. Only the two modes that name a behaviour explicitly count as armed.
+ */
+function stalenessArmed(env = process.env) {
+    const raw = (env.RENOR_VAULT_STALENESS ?? '').trim().toLowerCase();
+    return raw === 'warn' || raw === 'fatal';
+}
+/**
+ * The `search --json` field for a staleness verdict, or nothing.
+ *
+ * The machine-readable transport is a FROZEN public contract: its own test
+ * (`tests/context/product-read-context-contract.test.ts`, "adds nothing to the
+ * response when the flag is unset") requires the un-armed response to be
+ * byte-identical to the shipped one — no new top-level key.
+ *
+ * That is why the verdict is OPT-IN, and why the earlier "stale-only" rule was not enough.
+ * Stale-only kept the key off a healthy vault, but the shipped contract test's fixture is a
+ * plain, non-git folder (`kind: 'plain'`, never stale), so it could not see the stale path:
+ * a stale vault with `RENOR_VAULT_STALENESS` UNSET still returned `['hits','vaultStaleness']`
+ * and the repo's own assertion failed on exactly that vault
+ * (`expected [ 'hits', 'vaultStaleness' ] to deeply equal [ 'hits' ]`). Measured, not reasoned.
+ *
+ * So the field is attached only when the guard is EXPLICITLY armed (see `stalenessArmed`) AND
+ * the vault is stale. An operator who types `RENOR_VAULT_STALENESS=warn` gets the signal on
+ * the client surface as well as on stderr; an operator who types nothing gets a response
+ * byte-identical to the shipped one, stale or not. `off` mutes the field as it mutes the banner.
+ */
+function stalenessJsonField(staleness, opts = {}) {
+    const mode = opts.mode ?? stalenessMode();
+    const armed = opts.armed ?? stalenessArmed();
+    if (!armed || mode === 'off' || !staleness.stale)
+        return {};
+    return { vaultStaleness: staleness };
+}
+/**
+ * Gate helper for cli.ts setup(): evaluate + render. Pure — no process.exit,
+ * no console. The caller prints stderrLines and may refuse to continue.
+ *
+ * WHICH SIGNAL IS FATAL, stated because the two are different kinds of evidence:
+ *
+ *   - HARD, fatal-capable: `behind > 0` — HEAD is behind the ALREADY-FETCHED upstream ref.
+ *     The local checkout provably does not have commits upstream already has, so refusing to
+ *     serve is refusing to serve content that is known to be old.
+ *   - ADVISORY, never fatal: `headAgeDays > maxHeadAgeDays` — the checkout has received no
+ *     commits for N days. It exists because `behind` cannot see a stale FETCH (nothing fetched
+ *     means nothing to be behind of), but age alone is a heuristic about activity, not proof
+ *     that the content is outdated: a quiet vault whose HEAD still matches its upstream would
+ *     otherwise be taken offline by `fatal` with no knob to tune the threshold.
+ *
+ * So `fatal` fires only on the hard signal. An age-only verdict still renders its banner and
+ * still reaches the JSON field when the guard is armed; it just does not stop serving.
+ */
+function stalenessGate(vaultPath, opts = {}) {
+    const mode = opts.mode ?? stalenessMode();
+    const staleness = checkVaultStaleness(vaultPath, opts);
+    const hardEvidence = (staleness.behind ?? 0) > 0;
+    const stderrLines = [];
+    if (staleness.stale && mode !== 'off') {
+        for (const r of staleness.reasons) {
+            stderrLines.push(`[staleness] VAULT STALE: ${r}`);
+        }
+        // The hint must not contradict the narrowed rule: telling an operator who is ALREADY in
+        // `fatal` mode to "set =fatal to fail startup" is noise, and calling an age-only verdict
+        // "out-of-date" asserts more than age establishes.
+        stderrLines.push(hardEvidence
+            ? '[staleness] serving an out-of-date vault silently caused defect D1; set RENOR_VAULT_STALENESS=fatal to fail startup, or off to mute'
+            : '[staleness] the age signal is ADVISORY and never refuses service; only HEAD behind its already-fetched upstream is fatal. Set RENOR_VAULT_STALENESS=off to mute');
+    }
+    return { stderrLines, fatal: mode === 'fatal' && hardEvidence, staleness };
+}

package/dist/indexer/tokenizer.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * The engine's token counter, loaded on first use rather than at import time.
+ *
+ * WHY THIS IS LAZY, with the measurement rather than the intuition: requiring
+ * `gpt-tokenizer` cost ~344 ms on Node 22, of which ~205 ms is the o200k_base
+ * BPE ranks table — the single heaviest module on a cold start of
+ * dist/mvp/cli.js, ahead of express (97 ms) and the MCP SDK (205 ms). Both of
+ * the engine's entry paths need a count eventually (the chunker when it cuts a
+ * note, the context assembler when it budgets a reply), so this is not a module
+ * that can be dropped; it is one that a wake does not need yet.
+ *
+ * WHY IT IS ./o200k AND NOT gpt-tokenizer ANY MORE: gpt-tokenizer builds a Map of
+ * 200,000 strings, which is ~45 MiB of resident memory in every running
+ * workspace for ever after its first count (~60 MiB under load). ./o200k counts
+ * the same tokens from ~4 MiB of typed arrays; tests/indexer/o200k-counter.test.ts
+ * holds its counts equal to gpt-tokenizer's. gpt-tokenizer stays a dependency for
+ * the evaluation harness and for those tests, which are the oracle.
+ * docs/performance/MEMORY-PER-WORKSPACE.md has the measurement.
+ *
+ * WHY IT IS SAFE: a count is a pure function of its input. There is no
+ * construction cost, no ordering requirement, no ambient state to initialise and
+ * nothing that observes whether it was imported eagerly. The only observable
+ * difference is WHEN the vocabulary is built, and this file is the single place
+ * that decides that.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodeTokens = encodeTokens;
+exports.tokenizerLoaded = tokenizerLoaded;
+const o200k_1 = require("./o200k");
+/**
+ * A run of one kind of character (all whitespace, or none) this long is not encoded. The encoder's merge loop costs
+ * time quadratic in the length of such a run: 60,000 characters of `x` take ~5 s, where prose of the same size takes
+ * ~3 ms. Real text has no runs this long, so only a pathological or pasted blob reaches it.
+ */
+const LONG_RUN = 1_000;
+const RUN_RE = /\S+|\s+/g;
+/**
+ * Characters per token for a long run, measured on this encoder (o200k): 60,000 `x` are 7,500 tokens and 60,000
+ * spaces are 471. A blob of base64 or minified code is nearer the first, so the estimate is a middle figure for
+ * non-space runs, and a generous one for whitespace.
+ */
+const CHARS_PER_TOKEN = { text: 4, space: 128 };
+/**
+ * The token count of `text`, with the counter loaded on first call.
+ *
+ * Special token syntax (`<|im_start|>`, `<|endoftext|>`, …) is counted as plain
+ * text, not refused: it can legitimately appear inside note CONTENT, and
+ * gpt-tokenizer rejects such text as chat protocol by default. Counting it as
+ * plain text is what keeps indexing from failing closed on an imported ShareGPT
+ * history.
+ *
+ * A run of at least LONG_RUN characters is estimated (see CHARS_PER_TOKEN) and taken out of the text the encoder
+ * sees, so the estimate is not its exact count. Text without such a run is counted exactly, as before.
+ */
+function encodeTokens(text) {
+    let estimated = 0;
+    let rest = text;
+    if (text.length >= LONG_RUN) {
+        const runs = text.match(RUN_RE) ?? [];
+        if (runs.some(run => run.length >= LONG_RUN)) {
+            rest = runs
+                .map(run => {
+                if (run.length < LONG_RUN)
+                    return run;
+                estimated += Math.ceil(run.length / (/\s/.test(run) ? CHARS_PER_TOKEN.space : CHARS_PER_TOKEN.text));
+                return ' ';
+            })
+                .join('');
+        }
+    }
+    return (0, o200k_1.countO200k)(rest) + estimated;
+}
+/** True once the counter module has actually been loaded. Diagnostics and tests. */
+function tokenizerLoaded() {
+    return (0, o200k_1.o200kLoaded)();
+}

package/dist/indexer/walker.js

@@ -0,0 +1,184 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.walkVault = walkVault;
+exports.walkVaultStats = walkVaultStats;
+exports.statVaultFiles = statVaultFiles;
+exports.vaultIgnores = vaultIgnores;
+exports.isIgnoredByVault = isIgnoredByVault;
+const promises_1 = __importDefault(require("fs/promises"));
+const fs_1 = __importDefault(require("fs"));
+const buffer_1 = require("buffer");
+const path_1 = __importDefault(require("path"));
+const DEFAULT_IGNORE = ['.obsidian/', '.trash/', '.semantic-memory/', '.memory-index/', 'node_modules/'];
+/**
+ * The vault's ignore test, built once per walk instead of rebuilt for every entry: a relative path is
+ * ignored when a pattern names it, a directory above it, a directory anywhere inside it, or its last segment.
+ */
+function compileIgnore(patterns) {
+    const rules = patterns.map(p => {
+        const clean = p.replace(/\/$/, '');
+        return { clean, dir: clean + '/', inside: '/' + clean + '/', tail: '/' + clean };
+    });
+    return rel => rules.some(r => rel === r.clean || rel.startsWith(r.dir) || rel.includes(r.inside) || rel.endsWith(r.tail));
+}
+async function walkVault(vaultPath, options = {}) {
+    let patterns = [...DEFAULT_IGNORE, ...(options.ignorePatterns ?? [])];
+    try {
+        const raw = await promises_1.default.readFile(path_1.default.join(vaultPath, '.semanticignore'), 'utf8');
+        const fromFile = raw
+            .split('\n')
+            .map(l => l.trim())
+            .filter(l => l && !l.startsWith('#'));
+        patterns = [...patterns, ...fromFile];
+    }
+    catch {
+        /* no .semanticignore */
+    }
+    const ignored = compileIgnore(patterns);
+    const results = [];
+    /**
+     * `relDir` is the folder's path below the vault. `raw` is the folder as bytes and `shown` its path below the
+     * vault as a message writes it; both are set once a name on the way down is not valid UTF-8, because `dir`
+     * then names nothing real.
+     */
+    async function walk(dir, relDir, raw, shown) {
+        // Names are read as bytes only to report the ones that are not UTF-8; otherwise as strings, which Node decodes
+        // the same way. Every save walks the vault, so this and the join below are paid per file per save.
+        const entries = options.onNonUtf8Markdown
+            ? await promises_1.default.readdir(raw ?? dir, { withFileTypes: true, encoding: 'buffer' })
+            : await promises_1.default.readdir(dir, { withFileTypes: true });
+        // `path.join(dir, name)` for a name read from a folder (one segment, never `.` or `..`): the folder as join
+        // writes it, joined once per folder rather than once per entry.
+        const folder = path_1.default.join(dir, 'x').slice(0, -1);
+        for (const entry of entries) {
+            const bytes = typeof entry.name === 'string' ? null : entry.name;
+            const name = bytes ? bytes.toString('utf8') : entry.name;
+            const full = folder + name;
+            const rel = relDir ? relDir + path_1.default.sep + name : name;
+            if (ignored(rel))
+                continue;
+            if (options.onNonUtf8Markdown && bytes && (raw || !(0, buffer_1.isUtf8)(bytes))) {
+                const prefix = shown ?? relDir.split(path_1.default.sep).filter(Boolean).map(showName).join('/');
+                const label = prefix ? `${prefix}/${showName(bytes)}` : showName(bytes);
+                if (entry.isDirectory())
+                    await walk(full, rel, Buffer.concat([raw ?? Buffer.from(dir), Buffer.from(path_1.default.sep), bytes]), label);
+                else if (entry.isFile() && name.endsWith('.md'))
+                    options.onNonUtf8Markdown(label);
+                continue;
+            }
+            if (entry.isDirectory())
+                await walk(full, rel);
+            else if (entry.isFile() && name.endsWith('.md'))
+                results.push(full);
+        }
+    }
+    await walk(vaultPath, '');
+    return results;
+}
+/**
+ * A name as a message writes it: valid UTF-8 as it is, every other byte as `\xNN`, and a
+ * backslash or control character the same way (the backslash doubled), so the result is
+ * unambiguous, one line, and cannot carry a terminal escape sequence.
+ */
+function showName(name) {
+    const bytes = typeof name === 'string' ? Buffer.from(name) : name;
+    let shown = '';
+    for (let i = 0; i < bytes.length;) {
+        const lead = bytes[i];
+        const length = lead < 0xc2 ? 1 : lead < 0xe0 ? 2 : lead < 0xf0 ? 3 : lead < 0xf5 ? 4 : 0;
+        const isC1Control = lead === 0xc2 && bytes[i + 1] < 0xa0; // U+0080-U+009F
+        if (lead >= 0x80 && length > 0 && i + length <= bytes.length && (0, buffer_1.isUtf8)(bytes.subarray(i, i + length)) && !isC1Control) {
+            shown += bytes.toString('utf8', i, i + length);
+            i += length;
+            continue;
+        }
+        if (lead === 0x5c)
+            shown += '\\\\';
+        else if (lead >= 0x80 || lead < 0x20 || lead === 0x7f)
+            shown += `\\x${lead.toString(16).padStart(2, '0')}`;
+        else
+            shown += String.fromCharCode(lead);
+        i += 1;
+    }
+    return shown;
+}
+const STAT_CHUNK = 512;
+/**
+ * The files walkVault lists, each with the stat fields above, for a caller that wants to know what changed
+ * without reading anything. Stats are synchronous (a few microseconds each, against tens for an asynchronous
+ * call that fans out over the thread pool) in chunks, with a turn of the event loop between them. A file that
+ * vanishes between the listing and its stat is left out; one whose stat fails for another reason is listed with
+ * a stamp that never matches, so whoever reads it reports the error as a full pass would.
+ */
+async function walkVaultStats(vaultPath, options = {}) {
+    const files = await walkVault(vaultPath, options);
+    const stats = [];
+    for (let i = 0; i < files.length; i += STAT_CHUNK) {
+        for (const file of files.slice(i, i + STAT_CHUNK)) {
+            const s = statVaultFile(file);
+            if (s)
+                stats.push(s);
+        }
+        if (i + STAT_CHUNK < files.length)
+            await new Promise(resolve => setImmediate(resolve));
+    }
+    return stats;
+}
+/** One file's stat (see walkVaultStats): undefined when it is gone, a stamp that never matches when its stat fails. */
+function statVaultFile(file) {
+    try {
+        const s = fs_1.default.statSync(file, { throwIfNoEntry: false });
+        return s ? { file, mtimeMs: s.mtimeMs, ctimeMs: s.ctimeMs, size: s.size, ino: s.ino } : undefined;
+    }
+    catch {
+        return { file, mtimeMs: NaN, ctimeMs: NaN, size: -1, ino: -1 };
+    }
+}
+/**
+ * The stat of each of the listed files that is there, for a caller that names the files it wants to check (a save's)
+ * instead of walking the vault. A file that is gone is left out, as walkVaultStats leaves it out.
+ */
+function statVaultFiles(files) {
+    const stats = [];
+    for (const file of files) {
+        const s = statVaultFile(file);
+        if (s)
+            stats.push(s);
+    }
+    return stats;
+}
+/**
+ * The vault's ignore rules as walkVault applies them, for a caller that names files instead of listing them: true when the
+ * walk would never reach the file, which it prunes at an ignored folder as well as skipping an ignored file. Reads
+ * .semanticignore once, when asked.
+ */
+async function vaultIgnores(vaultPath) {
+    let patterns = [...DEFAULT_IGNORE];
+    try {
+        const raw = await promises_1.default.readFile(path_1.default.join(vaultPath, '.semanticignore'), 'utf8');
+        patterns = [...patterns, ...raw.split('\n').map(l => l.trim()).filter(l => l && !l.startsWith('#'))];
+    }
+    catch { /* no .semanticignore */ }
+    const ignored = compileIgnore(patterns);
+    return (file) => {
+        const parts = path_1.default.relative(vaultPath, file).split(path_1.default.sep);
+        return parts.some((_, i) => ignored(parts.slice(0, i + 1).join(path_1.default.sep)));
+    };
+}
+/**
+ * Whether the vault's own ignore rules (the defaults and .semanticignore) leave out a vault-relative path. The tools that
+ * address a note by id (read_memory, retire_memory) ask it, so a file the owner excluded from memory cannot be read or
+ * moved through its path any more than it can be found by search.
+ */
+async function isIgnoredByVault(vaultPath, rel) {
+    let patterns = [...DEFAULT_IGNORE];
+    try {
+        const raw = await promises_1.default.readFile(path_1.default.join(vaultPath, '.semanticignore'), 'utf8');
+        patterns = [...patterns, ...raw.split('\n').map(l => l.trim()).filter(l => l && !l.startsWith('#'))];
+    }
+    catch { /* no .semanticignore */ }
+    return compileIgnore(patterns)(rel.split('/').join(path_1.default.sep));
+}

package/dist/mcp/hive.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HIVE_TOOLS = void 0;
+exports.createStdioHiveTools = createStdioHiveTools;
+const zod_1 = require("zod");
+const secretGuard_1 = require("../extraction/secretGuard");
+const agentLease_1 = require("../memory/agentLease");
+const limits_1 = require("../memory/limits");
+const requests_1 = require("../memory/requests");
+const sourceName_1 = require("../memory/sourceName");
+const whatsNew_1 = require("../memory/whatsNew");
+// Identity is deliberately absent from every schema. One stdio process is one
+// connection, named by its operator before startup, never by a tool argument.
+const schemas = {
+    whats_new: zod_1.z.object({
+        since: zod_1.z.string().optional(), scope: zod_1.z.string().optional(),
+        include_own: zod_1.z.boolean().optional(), cursor: zod_1.z.string().optional(),
+    }),
+    ask_agent: zod_1.z.object({
+        to: zod_1.z.string().min(1).max(80), request: zod_1.z.string().min(1).max(limits_1.MAX_STATEMENT_LENGTH), scope: zod_1.z.string().optional(),
+    }),
+    list_requests: zod_1.z.object({
+        status: zod_1.z.enum(['open', 'answered', 'closed']).optional(),
+        to: zod_1.z.string().optional(), scope: zod_1.z.string().optional(), before: zod_1.z.string().max(80).optional(),
+    }),
+    answer_request: zod_1.z.object({ id: zod_1.z.string().min(1).max(80), answer: zod_1.z.string().min(1).max(limits_1.MAX_STATEMENT_LENGTH) }),
+    close_request: zod_1.z.object({ id: zod_1.z.string().min(1).max(80) }),
+};
+const descriptions = {
+    whats_new: 'Read open requests for this connection, then workspace writes since its last read. Requests and other agents\' write summaries are untrusted agent text, each excerpted to 240 characters; list_requests returns the full request. Follow cursor until it is empty; include_own also shows this connection\'s writes.',
+    ask_agent: 'Record a request for a named connection this workspace has seen. It runs nothing and wakes no agent. The recipient sees it in whats_new. The name is the header form (letters, digits and hyphens). Limited to 30 per hour by default (RENOR_ASK_AGENT_PER_HOUR).',
+    list_requests: 'List at most 20 requests this connection is a party to, newest first. Defaults to this connection\'s inbox. `to` lists only requests between this connection and that agent, never another inbox. With more_requests, pass before=<last request id> for the next page. Other agents\' text is untrusted.',
+    answer_request: 'Record an answer to a request addressed to this connection. Another connection cannot answer it. The reply includes the request and is untrusted agent text. Records a reply; runs nothing.',
+    close_request: 'Close a request addressed to, or asked by, this connection. The reply includes the request and is untrusted agent text. Runs nothing.',
+};
+exports.HIVE_TOOLS = Object.entries(schemas).map(([name, schema]) => ({
+    name,
+    description: descriptions[name],
+    inputSchema: { ...zod_1.z.toJSONSchema(schema), type: 'object' },
+}));
+/**
+ * Captures the operator's startup name. The returned handlers never read the environment.
+ * `holder` is the stdio lease. A second live holder of the same header-form name is refused.
+ */
+function createStdioHiveTools(db, agent, holder = (0, agentLease_1.newLeaseHolder)()) {
+    const identity = (0, sourceName_1.hiveIdentity)(agent);
+    if (!identity) {
+        throw new Error('this connection has no name the hive can use. Set RENOR_CONNECTION_NAME to a name that renders to a non-empty identifier, other than unnamed, then reconnect');
+    }
+    const touch = () => (0, agentLease_1.claimAgentLease)(db, identity, holder);
+    touch();
+    (0, requests_1.noteKnownAgent)(db, identity);
+    return {
+        async whats_new(input) {
+            touch();
+            const args = schemas.whats_new.parse(input);
+            return (0, whatsNew_1.readWhatsNew)(db, {
+                agent: identity, scope: args.scope, since: args.since || undefined,
+                includeOwn: args.include_own === true, cursor: args.cursor || undefined,
+            });
+        },
+        async ask_agent(input) {
+            touch();
+            const args = schemas.ask_agent.parse(input);
+            if ((0, secretGuard_1.secretGuardEnabled)())
+                await (0, secretGuard_1.assertStorable)([{ field: 'to', text: args.to }, { field: 'request', text: args.request }]);
+            return (0, requests_1.askAgent)(db, { from: identity, to: args.to, request: args.request, scope: args.scope, knownOnly: true, perHour: (0, requests_1.askAgentPerHour)() });
+        },
+        async list_requests(input) {
+            touch();
+            const args = schemas.list_requests.parse(input);
+            const page = (0, requests_1.listRequestsPage)(db, { agent: identity, ...args });
+            return { ...page, requests: page.requests.map(r => ({ ...r, untrusted: true })) };
+        },
+        async answer_request(input) {
+            touch();
+            const args = schemas.answer_request.parse(input);
+            if ((0, secretGuard_1.secretGuardEnabled)())
+                await (0, secretGuard_1.assertStorable)([{ field: 'answer', text: args.answer }]);
+            return { ...(0, requests_1.answerRequest)(db, { agent: identity, ...args }), untrusted: true };
+        },
+        async close_request(input) {
+            touch();
+            const args = schemas.close_request.parse(input);
+            return { ...(0, requests_1.closeRequest)(db, { agent: identity, ...args }), untrusted: true };
+        },
+    };
+}

package/dist/mcp/requestErrors.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isZodError = isZodError;
+exports.oneLineInvalidParams = oneLineInvalidParams;
+exports.mapInvalidParams = mapInvalidParams;
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+function isZodError(error) {
+    // The SDK's schema parse throws zod v4's `$ZodError`; the transport's parse throws classic `ZodError`.
+    return error instanceof Error && /ZodError$/.test(error.name) && Array.isArray(error.issues);
+}
+/**
+ * A request whose params the SDK's schema refuses is answered with the error its parser threw: a ZodError has
+ * no code, so the SDK sends -32603 with the issue list as its message. The client asked wrongly, so the answer is
+ * -32602 with one line that names the field. The error carries the code the SDK reads (Protocol sends
+ * `error.code` when it is a safe integer).
+ */
+function oneLineInvalidParams(error) {
+    if (!isZodError(error))
+        return error;
+    const detail = error.issues
+        .map(issue => `${issue.path.map(String).join('.') || 'params'}: ${issue.message}`)
+        .join('; ');
+    const message = `Invalid params: ${detail}`;
+    return Object.assign(new Error(message.length > 300 ? `${message.slice(0, 297)}...` : message), {
+        code: types_js_1.ErrorCode.InvalidParams,
+    });
+}
+/**
+ * Wraps every request handler the server has registered, the SDK's own `initialize` included, so a schema refusal
+ * reaches the client as -32602. The SDK keeps its handlers in a private map and parses each request inside the
+ * handler it stores, so the only place a refusal can be turned into the right code is this wrapper. Call it after
+ * every handler is registered and before the transport connects. An SDK that renames the map throws here at startup,
+ * and the standing tests catch it before a release.
+ */
+function mapInvalidParams(server) {
+    const handlers = server._requestHandlers;
+    for (const [method, handler] of handlers) {
+        handlers.set(method, async (request, extra) => {
+            try {
+                return await handler(request, extra);
+            }
+            catch (error) {
+                throw oneLineInvalidParams(error);
+            }
+        });
+    }
+}