sparda-mcp 0.5.2 → 0.5.4

package/src/server/context-carrier.js

@@ -71,8 +71,8 @@ function assertNoCRLF(headerName, value) {
       new Error(`context value for "${headerName}" has illegal control chars`),
       {
         code: 'USER',
-        hint: `${headerName} must be a single header line — no CR, LF, or NUL`
-      }
+        hint: `${headerName} must be a single header line — no CR, LF, or NUL`,
+      },
     );
   }
 }
@@ -96,10 +96,10 @@ export function validateConfig(config) {
   if (typeof config !== 'object' || Array.isArray(config)) {
     return {
       valid: false,
-      error: Object.assign(
-        new Error('contextPropagation must be an object'),
-        { code: 'USER', hint: 'Remove the key or provide a valid object' }
-      )
+      error: Object.assign(new Error('contextPropagation must be an object'), {
+        code: 'USER',
+        hint: 'Remove the key or provide a valid object',
+      }),
     };
   }
 
@@ -107,10 +107,10 @@ export function validateConfig(config) {
   if (config.mode !== undefined && config.mode !== 'verbatim') {
     return {
       valid: false,
-      error: Object.assign(
-        new Error('contextPropagation.mode must be "verbatim"'),
-        { code: 'USER', hint: 'Only "verbatim" is supported — SPARDA never interprets context' }
-      )
+      error: Object.assign(new Error('contextPropagation.mode must be "verbatim"'), {
+        code: 'USER',
+        hint: 'Only "verbatim" is supported — SPARDA never interprets context',
+      }),
     };
   }
 
@@ -119,9 +119,14 @@ export function validateConfig(config) {
     return {
       valid: false,
       error: Object.assign(
-        new Error('contextPropagation.from "mcp.session.metadata" is not supported (§0: caller-supplied context is insecure)'),
-        { code: 'USER', hint: 'Remove "from" or set it to "launch". Values come from CLI flag or env vars.' }
-      )
+        new Error(
+          'contextPropagation.from "mcp.session.metadata" is not supported (§0: caller-supplied context is insecure)',
+        ),
+        {
+          code: 'USER',
+          hint: 'Remove "from" or set it to "launch". Values come from CLI flag or env vars.',
+        },
+      ),
     };
   }
 
@@ -131,8 +136,8 @@ export function validateConfig(config) {
       valid: false,
       error: Object.assign(
         new Error('contextPropagation.from must be "launch" or absent'),
-        { code: 'USER', hint: 'Only operator-pinned launch-time context is supported' }
-      )
+        { code: 'USER', hint: 'Only operator-pinned launch-time context is supported' },
+      ),
     };
   }
 
@@ -141,10 +146,10 @@ export function validateConfig(config) {
     if (!Array.isArray(config.headers)) {
       return {
         valid: false,
-        error: Object.assign(
-          new Error('contextPropagation.headers must be an array'),
-          { code: 'USER', hint: 'Provide an array of header name strings' }
-        )
+        error: Object.assign(new Error('contextPropagation.headers must be an array'), {
+          code: 'USER',
+          hint: 'Provide an array of header name strings',
+        }),
       };
     }
 
@@ -153,8 +158,8 @@ export function validateConfig(config) {
         valid: false,
         error: Object.assign(
           new Error(`contextPropagation.headers exceeds max ${MAX_HEADERS} items`),
-          { code: 'USER', hint: `Reduce to ${MAX_HEADERS} headers or fewer` }
-        )
+          { code: 'USER', hint: `Reduce to ${MAX_HEADERS} headers or fewer` },
+        ),
       };
     }
 
@@ -162,10 +167,10 @@ export function validateConfig(config) {
       if (typeof h !== 'string' || h.length === 0) {
         return {
           valid: false,
-          error: Object.assign(
-            new Error('Each header must be a non-empty string'),
-            { code: 'USER', hint: 'Check all items in contextPropagation.headers' }
-          )
+          error: Object.assign(new Error('Each header must be a non-empty string'), {
+            code: 'USER',
+            hint: 'Check all items in contextPropagation.headers',
+          }),
         };
       }
     }
@@ -260,7 +265,7 @@ export function resolveContext({ argv = [], env = {}, config = null } = {}) {
       if (Buffer.byteLength(value, 'utf8') > MAX_VALUE_BYTES) {
         throw Object.assign(
           new Error(`context value for "${headerName}" exceeds ${MAX_VALUE_BYTES} bytes`),
-          { code: 'USER', hint: 'Shorten the value or split across multiple headers' }
+          { code: 'USER', hint: 'Shorten the value or split across multiple headers' },
         );
       }
 
@@ -270,10 +275,10 @@ export function resolveContext({ argv = [], env = {}, config = null } = {}) {
 
   // Bounds: total header count (defensive — already bounded by declaredHeaders.length ≤ 8)
   if (Object.keys(resolved).length > MAX_HEADERS) {
-    throw Object.assign(
-      new Error(`context exceeds max ${MAX_HEADERS} headers`),
-      { code: 'USER', hint: `Declare at most ${MAX_HEADERS} headers in contextPropagation` }
-    );
+    throw Object.assign(new Error(`context exceeds max ${MAX_HEADERS} headers`), {
+      code: 'USER',
+      hint: `Declare at most ${MAX_HEADERS} headers in contextPropagation`,
+    });
   }
 
   return Object.freeze({ headers: Object.freeze(resolved) });
@@ -313,7 +318,7 @@ export function fingerprintContext(ctx) {
   for (const [name, value] of Object.entries(ctx.headers)) {
     fp[name] = {
       present: true,
-      hash: createHash('sha256').update(value).digest('hex').slice(0, 8)
+      hash: createHash('sha256').update(value).digest('hex').slice(0, 8),
     };
   }
   return fp;

package/src/server/crystallize.js

@@ -9,10 +9,14 @@ import { walkPayload } from './condenser.js';
 // crystallizable = every step is an enabled GET and every link knows where to
 // re-feed from. Re-checked at every bridge start: tools change, circuits stay.
 export function eligibleForCrystallization(circuit, toolSpecs) {
-  return Array.isArray(circuit.steps) && circuit.steps.length >= 2 &&
+  return (
+    Array.isArray(circuit.steps) &&
+    circuit.steps.length >= 2 &&
     circuit.steps.every((s) => toolSpecs[s]?.enabled && toolSpecs[s].method === 'GET') &&
-    Array.isArray(circuit.links) && circuit.links.length > 0 &&
-    circuit.links.every((l) => typeof l.fromKey === 'string' && l.fromKey.length > 0);
+    Array.isArray(circuit.links) &&
+    circuit.links.length > 0 &&
+    circuit.links.every((l) => typeof l.fromKey === 'string' && l.fromKey.length > 0)
+  );
 }
 
 // graceful degradation (survival rule): no sampling → a deterministic name and
@@ -30,8 +34,12 @@ export function fallbackComposite(circuit) {
 
 // a sampled name is untrusted input: normalize hard, reject anything shapeless
 export function normalizeCompositeName(raw) {
-  const n = String(raw ?? '').toLowerCase().trim()
-    .replace(/[^a-z0-9_]+/g, '_').replace(/^_+|_+$/g, '').slice(0, 40);
+  const n = String(raw ?? '')
+    .toLowerCase()
+    .trim()
+    .replace(/[^a-z0-9_]+/g, '_')
+    .replace(/^_+|_+$/g, '')
+    .slice(0, 40);
   return /^[a-z][a-z0-9_]{2,}$/.test(n) ? n : null;
 }
 
@@ -43,7 +51,10 @@ export function compositeSchema(circuit, toolSpecs) {
   for (const step of circuit.steps) {
     for (const p of toolSpecs[step]?.params ?? []) {
       if (autoFed.has(`${step}:${p.name}`) || properties[p.name]) continue;
-      properties[p.name] = { type: p.type === 'unknown' ? 'string' : p.type, description: `${p.description ?? p.in} (for ${step})` };
+      properties[p.name] = {
+        type: p.type === 'unknown' ? 'string' : p.type,
+        description: `${p.description ?? p.in} (for ${step})`,
+      };
       if (p.required) required.push(p.name);
     }
   }
@@ -55,7 +66,10 @@ export function compositeSchema(circuit, toolSpecs) {
 export function findByKey(node, key) {
   let found;
   walkPayload(node, (k, v) => {
-    if (k === key) { found = v; return false; }
+    if (k === key) {
+      found = v;
+      return false;
+    }
   });
   return found;
 }
@@ -78,8 +92,17 @@ export async function runComposite({ circuit, args, toolSpecs, invokeFn }) {
     }
     const payload = await invokeFn(step, stepArgs);
     const status = payload?.upstreamStatus;
-    trace.push({ tool: step, upstreamStatus: status ?? null, ...(payload?.error ? { error: payload.error } : {}) });
-    if (!payload || payload.error !== undefined || status === undefined || status >= 400) {
+    trace.push({
+      tool: step,
+      upstreamStatus: status ?? null,
+      ...(payload?.error ? { error: payload.error } : {}),
+    });
+    if (
+      !payload ||
+      payload.error !== undefined ||
+      status === undefined ||
+      status >= 400
+    ) {
       return { ok: false, trace }; // honest failure: stop the chain, show where
     }
     outputs[step] = payload.data;

package/src/server/engine.js

@@ -14,7 +14,13 @@
 //     protect (rule #5) — same posture as the router's purity detector.
 
 // bounded memory, same philosophy as antibodies (ADR-010) and circuits.
-export const ENGINE_LIMITS = { MAX_TOOLS: 100, MAX_FIELDS: 60, MAX_TS: 50, MAX_AXONS: 200, MAX_GHOSTS: 200 };
+export const ENGINE_LIMITS = {
+  MAX_TOOLS: 100,
+  MAX_FIELDS: 60,
+  MAX_TS: 50,
+  MAX_AXONS: 200,
+  MAX_GHOSTS: 200,
+};
 
 // FNV-1a 32-bit: collapses a field's value to a fixed token so change can be
 // detected without retaining the value. Non-crypto on purpose — nothing heavy,
@@ -29,7 +35,11 @@ function fnv1a(str) {
 }
 
 function safeStringify(v) {
-  try { return JSON.stringify(v) ?? 'null'; } catch { return String(v); }
+  try {
+    return JSON.stringify(v) ?? 'null';
+  } catch {
+    return String(v);
+  }
 }
 
 // top-level field fingerprints only — bounded, value-free. A non-object body
@@ -71,25 +81,36 @@ export function createPredictiveEngine() {
     const changed = [];
     for (const [k, h] of hashes) {
       const f = rec.fields.get(k);
-      if (!f) { // a field that wasn't there before is itself a change of shape
-        if (rec.fields.size < ENGINE_LIMITS.MAX_FIELDS) rec.fields.set(k, { hash: h, seen: 1, changed: 0 });
+      if (!f) {
+        // a field that wasn't there before is itself a change of shape
+        if (rec.fields.size < ENGINE_LIMITS.MAX_FIELDS)
+          rec.fields.set(k, { hash: h, seen: 1, changed: 0 });
         changed.push(k);
         continue;
       }
       f.seen += 1;
-      if (f.hash !== h) { f.hash = h; f.changed += 1; changed.push(k); }
+      if (f.hash !== h) {
+        f.hash = h;
+        f.changed += 1;
+        changed.push(k);
+      }
     }
     // a field that vanished this call also counts as movement
     for (const k of rec.fields.keys()) if (!hashes.has(k)) changed.push(k);
 
-    if (changed.length === 0) { stats.noChange += 1; return { type: 'NO_CHANGE', tool }; }
+    if (changed.length === 0) {
+      stats.noChange += 1;
+      return { type: 'NO_CHANGE', tool };
+    }
     stats.delta += 1;
     return { type: 'DELTA', tool, changedFields: changed };
   }
 
   // after a write the underlying resource may have moved — drop the model so a
   // stale "stable" reading can't survive it. (Wired later; kept faithful here.)
-  function invalidate(tool) { tools.delete(tool); }
+  function invalidate(tool) {
+    tools.delete(tool);
+  }
 
   // names + counts only — never a value. A field is "stable" once it has been
   // seen more than once without ever changing; "volatile" the moment it moves;
@@ -122,7 +143,7 @@ const RHYTHM = { MIN_TS: 5, REGULARITY_THRESHOLD: 0.25 };
 // only call timestamps (plain numbers — never a payload, never PII), bounded per
 // tool, runtime-only.
 export function createRhythmDetector() {
-  const times = new Map();    // tool -> number[] (ms timestamps, ring)
+  const times = new Map(); // tool -> number[] (ms timestamps, ring)
   const patterns = new Map(); // tool -> { periodMs, confidence, observations, nextPredictedMs }
   const stats = { patternsDetected: 0 };
 
@@ -160,7 +181,10 @@ export function createRhythmDetector() {
     }
   }
 
-  function invalidate(tool) { times.delete(tool); patterns.delete(tool); }
+  function invalidate(tool) {
+    times.delete(tool);
+    patterns.delete(tool);
+  }
 
   // detected patterns only — names + cadence, never a value. nextEstimate is an
   // ISO instant so the reader can see WHEN the next call is expected.
@@ -195,7 +219,7 @@ const MYELIN = { THRESHOLD: 3, MAX_LAYERS: 10 };
 // real latency in the immune system and won't report an invented number.
 export function createMyelinTracker() {
   const axons = new Map(); // "src-->tgt" -> { strength, traversals, lastTs, myelinated }
-  let prev = null;         // the previously observed tool — the chain is the session
+  let prev = null; // the previously observed tool — the chain is the session
 
   function observe(tool, ts) {
     if (prev !== null && prev !== tool) reinforce(`${prev}-->${tool}`, ts); // no self-edges
@@ -220,7 +244,11 @@ export function createMyelinTracker() {
     let victimKey = null;
     let victim = null;
     for (const [k, a] of axons) {
-      if (!victim || a.strength < victim.strength || (a.strength === victim.strength && a.lastTs < victim.lastTs)) {
+      if (
+        !victim ||
+        a.strength < victim.strength ||
+        (a.strength === victim.strength && a.lastTs < victim.lastTs)
+      ) {
         victimKey = k;
         victim = a;
       }
@@ -276,7 +304,7 @@ export function createMyelinTracker() {
 const NOETHER = { MIN_OBS: 5, MIN_STABILITY: 0.85 };
 
 export function createNoetherScanner() {
-  const fields = new Map();     // tool -> Map<field, { first, total, matches }>
+  const fields = new Map(); // tool -> Map<field, { first, total, matches }>
   const writeTools = new Set(); // names of tools observed mutating (bounded)
 
   function observe(tool, result, isWrite) {
@@ -293,7 +321,8 @@ export function createNoetherScanner() {
     for (const [k, h] of fieldHashes(result)) {
       const f = rec.get(k);
       if (!f) {
-        if (rec.size < ENGINE_LIMITS.MAX_FIELDS) rec.set(k, { first: h, total: 1, matches: 1 });
+        if (rec.size < ENGINE_LIMITS.MAX_FIELDS)
+          rec.set(k, { first: h, total: 1, matches: 1 });
         continue;
       }
       f.total += 1;
@@ -301,7 +330,10 @@ export function createNoetherScanner() {
     }
   }
 
-  function invalidate(tool) { fields.delete(tool); writeTools.delete(tool); }
+  function invalidate(tool) {
+    fields.delete(tool);
+    writeTools.delete(tool);
+  }
 
   // conserved fields only — names + rates, never a value. Surfaced solely once writes
   // have been observed, so each invariant is a genuine "stable despite mutation" claim.
@@ -313,7 +345,12 @@ export function createNoetherScanner() {
           if (f.total < NOETHER.MIN_OBS) continue;
           const rate = f.matches / f.total;
           if (rate >= NOETHER.MIN_STABILITY) {
-            invariants.push({ tool, field, stability: Number(rate.toFixed(3)), observations: f.total });
+            invariants.push({
+              tool,
+              field,
+              stability: Number(rate.toFixed(3)),
+              observations: f.total,
+            });
           }
         }
       }
@@ -332,11 +369,11 @@ export function createNoetherScanner() {
 const GHOST = { MIN_OBS: 3, MIN_CORRELATION: 0.7 };
 
 export function createGravitationalLens() {
-  const lastHash = new Map();  // read tool -> last whole-result fingerprint
-  const corr = new Map();      // "W:::G" -> { hits, total }
-  let pendingWrite = null;     // the write whose effect we are still attributing
-  let snap = null;             // fingerprint of every read at the instant W fired
-  let scored = new Set();      // "W:::G" already counted this write episode
+  const lastHash = new Map(); // read tool -> last whole-result fingerprint
+  const corr = new Map(); // "W:::G" -> { hits, total }
+  let pendingWrite = null; // the write whose effect we are still attributing
+  let snap = null; // fingerprint of every read at the instant W fired
+  let scored = new Set(); // "W:::G" already counted this write episode
 
   function observe(tool, result, isWrite) {
     if (isWrite) {
@@ -348,7 +385,8 @@ export function createGravitationalLens() {
     const h = fnv1a(safeStringify(result));
     if (pendingWrite !== null && snap.has(tool)) {
       const key = `${pendingWrite}:::${tool}`;
-      if (!scored.has(key)) { // one vote per write episode — never inflate a repeated read
+      if (!scored.has(key)) {
+        // one vote per write episode — never inflate a repeated read
         scored.add(key);
         let c = corr.get(key);
         if (!c) {
@@ -360,7 +398,8 @@ export function createGravitationalLens() {
         if (snap.get(tool) !== h) c.hits += 1; // the write moved this read
       }
     }
-    if (lastHash.size < ENGINE_LIMITS.MAX_TOOLS || lastHash.has(tool)) lastHash.set(tool, h);
+    if (lastHash.size < ENGINE_LIMITS.MAX_TOOLS || lastHash.has(tool))
+      lastHash.set(tool, h);
   }
 
   // least-observed first; among equals, the least-correlated — same "weakest goes"
@@ -369,7 +408,11 @@ export function createGravitationalLens() {
     let victimKey = null;
     let victim = null;
     for (const [k, c] of corr) {
-      if (!victim || c.total < victim.total || (c.total === victim.total && c.hits < victim.hits)) {
+      if (
+        !victim ||
+        c.total < victim.total ||
+        (c.total === victim.total && c.hits < victim.hits)
+      ) {
         victimKey = k;
         victim = c;
       }
@@ -379,7 +422,10 @@ export function createGravitationalLens() {
 
   function invalidate(tool) {
     lastHash.delete(tool);
-    if (pendingWrite === tool) { pendingWrite = null; snap = null; }
+    if (pendingWrite === tool) {
+      pendingWrite = null;
+      snap = null;
+    }
     for (const k of [...corr.keys()]) {
       const [w, g] = k.split(':::');
       if (w === tool || g === tool) corr.delete(k);
@@ -394,7 +440,12 @@ export function createGravitationalLens() {
       const rate = c.hits / c.total;
       if (rate >= GHOST.MIN_CORRELATION) {
         const [writeTool, affects] = k.split(':::');
-        ghosts.push({ writeTool, affects, correlation: Number(rate.toFixed(3)), observations: c.total });
+        ghosts.push({
+          writeTool,
+          affects,
+          correlation: Number(rate.toFixed(3)),
+          observations: c.total,
+        });
       }
     }
     return { ghosts };
@@ -413,7 +464,10 @@ export function createDependencyMap() {
       noether.observe(tool, result, isWrite);
       lens.observe(tool, result, isWrite);
     },
-    invalidate(tool) { noether.invalidate(tool); lens.invalidate(tool); },
+    invalidate(tool) {
+      noether.invalidate(tool);
+      lens.invalidate(tool);
+    },
     snapshot() {
       const n = noether.snapshot();
       const l = lens.snapshot();
@@ -460,7 +514,9 @@ function canonicalize(v) {
   }
   return v;
 }
-function canonicalArgSig(args) { return safeStringify(canonicalize(args)); }
+function canonicalArgSig(args) {
+  return safeStringify(canonicalize(args));
+}
 
 export function createFlywheel() {
   // entryKey "tool::<fnv1a(argsig)>" -> { tool, hash, hits, value, ts }. The key
@@ -468,7 +524,9 @@ export function createFlywheel() {
   const cache = new Map();
   const stats = { served: 0, misses: 0, evictions: 0 };
 
-  function keyFor(tool, args) { return `${tool}::${fnv1a(canonicalArgSig(args))}`; }
+  function keyFor(tool, args) {
+    return `${tool}::${fnv1a(canonicalArgSig(args))}`;
+  }
 
   // hot-path surface (wired in 5b): return a cached value ONLY when proven pure and
   // fresh. now is injectable so freshness is deterministic in tests.
@@ -494,18 +552,29 @@ export function createFlywheel() {
       cache.set(k, { tool, hash: h, hits: 1, value: result, ts });
       return;
     }
-    if (e.hash === h) e.hits += 1;        // another identical sighting — closer to / past the bar
-    else { e.hash = h; e.hits = 1; }      // the answer moved — restart the proof
-    e.value = result;                     // latest bytes always win
-    e.ts = ts;                            // freshness from this real fetch
+    if (e.hash === h)
+      e.hits += 1; // another identical sighting — closer to / past the bar
+    else {
+      e.hash = h;
+      e.hits = 1;
+    } // the answer moved — restart the proof
+    e.value = result; // latest bytes always win
+    e.ts = ts; // freshness from this real fetch
   }
 
   // oldest fetch goes first — same "weakest goes" shape as circuits/axons/ghosts.
   function evictOldest() {
     let victimKey = null;
     let oldest = Infinity;
-    for (const [k, e] of cache) if (e.ts < oldest) { oldest = e.ts; victimKey = k; }
-    if (victimKey !== null) { cache.delete(victimKey); stats.evictions += 1; }
+    for (const [k, e] of cache)
+      if (e.ts < oldest) {
+        oldest = e.ts;
+        victimKey = k;
+      }
+    if (victimKey !== null) {
+      cache.delete(victimKey);
+      stats.evictions += 1;
+    }
   }
 
   // drop every entry for a tool — used by the spine to purge reads a write moved.
@@ -539,7 +608,9 @@ export function createSpardaEngine() {
     // hot-path serve (R4.3): ask the flywheel for a proven-stable answer before the
     // bridge pays the host. Always safe to call — returns {hit:false} until an organ
     // has proof. The bridge gates the *use* of a hit behind SPARDA_FLYWHEEL (5b).
-    preCall(tool, args) { return flywheel.preCall(tool, args); },
+    preCall(tool, args) {
+      return flywheel.preCall(tool, args);
+    },
     // ts is captured on the hot path (a cheap clock read) and passed in, so the
     // cadence reflects real call times — not whenever the idle harvester drains.
     // isWrite lets Bloc D separate state reads from mutations (a GET can't move the
@@ -554,18 +625,27 @@ export function createSpardaEngine() {
         // ghost map (the slice-4 payoff) instead of nuking the whole cache. Runs in
         // idle, so the bounded ghost scan never touches a request (rule #1).
         flywheel.invalidate(tool);
-        for (const g of deps.snapshot().ghosts) if (g.writeTool === tool) flywheel.invalidate(g.affects);
+        for (const g of deps.snapshot().ghosts)
+          if (g.writeTool === tool) flywheel.invalidate(g.affects);
       } else {
         flywheel.observe(tool, args, result, ts);
       }
       return predictive.observe(tool, result);
     },
-    invalidate(tool) { predictive.invalidate(tool); rhythm.invalidate(tool); myelin.invalidate(tool); deps.invalidate(tool); flywheel.invalidate(tool); },
+    invalidate(tool) {
+      predictive.invalidate(tool);
+      rhythm.invalidate(tool);
+      myelin.invalidate(tool);
+      deps.invalidate(tool);
+      flywheel.invalidate(tool);
+    },
     // structural cache purge (5b): only the bridge knows HTTP paths, so when a write
     // hits a path it asks us to drop the cached GET on that SAME path. Flywheel-only —
     // unlike invalidate(), it must NOT erase the sibling read's learned rhythm/myelin/
     // deps, only its now-stale cached answer.
-    invalidateCache(tool) { flywheel.invalidate(tool); },
+    invalidateCache(tool) {
+      flywheel.invalidate(tool);
+    },
     snapshot() {
       return {
         stability: predictive.snapshot(),

package/src/server/idle.js

@@ -4,7 +4,12 @@
 // at zero even while the organism digests.
 import { monitorEventLoopDelay } from 'node:perf_hooks';
 
-export function createIdleHarvester({ tickMs = 250, busyLagMs = 25, maxWaitMs = 5000, maxQueue = 200 } = {}) {
+export function createIdleHarvester({
+  tickMs = 250,
+  busyLagMs = 25,
+  maxWaitMs = 5000,
+  maxQueue = 200,
+} = {}) {
   const resolutionMs = 10;
   const histogram = monitorEventLoopDelay({ resolution: resolutionMs });
   histogram.enable();
@@ -19,7 +24,11 @@ export function createIdleHarvester({ tickMs = 250, busyLagMs = 25, maxWaitMs =
     const starving = Date.now() - queue[0].ts > maxWaitMs; // never wait forever on a loaded box
     if (Number.isFinite(lagMs) && lagMs > busyLagMs && !starving) return;
     const job = queue.shift();
-    try { job.fn(); } catch (e) { console.error(`[sparda] idle job failed (dropped): ${e.message}`); }
+    try {
+      job.fn();
+    } catch (e) {
+      console.error(`[sparda] idle job failed (dropped): ${e.message}`);
+    }
   }, tickMs);
   timer.unref?.();
 
@@ -33,10 +42,17 @@ export function createIdleHarvester({ tickMs = 250, busyLagMs = 25, maxWaitMs =
     flush() {
       while (queue.length) {
         const job = queue.shift();
-        try { job.fn(); } catch (e) { console.error(`[sparda] idle job failed (dropped): ${e.message}`); }
+        try {
+          job.fn();
+        } catch (e) {
+          console.error(`[sparda] idle job failed (dropped): ${e.message}`);
+        }
       }
     },
-    stop() { clearInterval(timer); histogram.disable(); },
+    stop() {
+      clearInterval(timer);
+      histogram.disable();
+    },
     pending: () => queue.length,
   };
 }

package/src/server/persistence.js

@@ -21,7 +21,6 @@
 import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
-import os from 'node:os';
 import crypto from 'node:crypto';
 
 // ───────────────────────────────────────────────────────────────────────────
@@ -63,7 +62,11 @@ export function atomicWriteFileSync(file, content) {
       return;
     } catch (err) {
       if (!TRANSIENT_LOCK_CODES.has(err.code) || attempt >= RENAME_MAX_ATTEMPTS) {
-        try { fs.unlinkSync(tmp); } catch { /* best effort */ }
+        try {
+          fs.unlinkSync(tmp);
+        } catch {
+          /* best effort */
+        }
         throw err;
       }
       sleepSync(RENAME_BACKOFF_MS * attempt); // 10, 20, 30, 40 ms — clears a brief AV/indexer lock
@@ -128,7 +131,11 @@ export class LocalFileDriver {
     fs.mkdirSync(this.#baseDir, { recursive: true });
   }
   #filePath(instanceId) {
-    const hash = crypto.createHash('sha256').update(instanceId).digest('hex').slice(0, 16);
+    const hash = crypto
+      .createHash('sha256')
+      .update(instanceId)
+      .digest('hex')
+      .slice(0, 16);
     return path.join(this.#baseDir, `sparda_${hash}.json`);
   }
   async save(instanceId, data) {
@@ -194,7 +201,10 @@ export class RedisDriver {
     } catch {
       throw Object.assign(
         new Error('RedisDriver requires the optional "ioredis" package.'),
-        { code: 'USER', hint: 'Run `npm install ioredis`, or use the default file driver.' },
+        {
+          code: 'USER',
+          hint: 'Run `npm install ioredis`, or use the default file driver.',
+        },
       );
     }
     this.#client = new Redis({
@@ -213,7 +223,8 @@ export class RedisDriver {
     try {
       await this.#ready;
       const payload = JSON.stringify(data);
-      if (this.#ttl > 0) await this.#client.setex(this.#key(instanceId), this.#ttl, payload);
+      if (this.#ttl > 0)
+        await this.#client.setex(this.#key(instanceId), this.#ttl, payload);
       else await this.#client.set(this.#key(instanceId), payload);
       return true;
     } catch {