token-goat 2.9.29 → 2.9.30

package/dist/{token-goat-chunk-PKRWMHVP.mjs → token-goat-chunk-ZQSJMO2R.mjs}

@@ -1,103 +1,124 @@
 import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
-  ABSENT_PIN,
   CONTENT_MAX_INPUT_CHARS,
-  ConfinementIdentityError,
+  checkSemanticReadiness,
   compressText,
   createHandoff,
-  fileIdentity,
-  findSpecSeparator,
-  parseColonLineSpec,
-  parseLineRange,
-  pinKey,
   resolveHandoff,
   retrieveText,
   runBrief,
   runChanged,
   runExports,
-  runGrep,
   runImports,
   runOutline,
-  runRead,
   runRefs,
   runSection,
   runSemantic,
   runSkeleton,
   runSymbol,
-  statThroughHandle,
+  statThroughHandle
+} from "./token-goat-chunk-CZ3LUXYZ.mjs";
+import "./token-goat-chunk-ZCDTCVIS.mjs";
+import {
+  ABSENT_PIN,
+  ConfinementIdentityError,
+  expandSpecPath,
+  fileIdentity,
+  findSpecSeparator,
+  parseColonLineSpec,
+  parseLineRange,
+  pinKey,
+  resolveProjectConfinement,
+  runGrep,
+  runRead,
   withPinnedReads
-} from "./token-goat-chunk-NMBWLRHW.mjs";
-import "./token-goat-chunk-VZQEWRVH.mjs";
-import "./token-goat-chunk-PQ53BSCF.mjs";
+} from "./token-goat-chunk-PU7V3FD6.mjs";
+import "./token-goat-chunk-XKI4SEMX.mjs";
+import "./token-goat-chunk-SMVRN2HU.mjs";
+import "./token-goat-chunk-4JJS54TR.mjs";
+import "./token-goat-chunk-RC35RBUL.mjs";
+import "./token-goat-chunk-5RG5SBL6.mjs";
+import "./token-goat-chunk-54K3EUV3.mjs";
+import "./token-goat-chunk-YARZFCZS.mjs";
 import {
   buildProjectMap,
   formatProjectMap,
-  getDirtyPathsFor,
   getEmbeddingCoverage,
   getProjectIndexCounts,
-  isWorkerRunning,
+  isIndexEmptyForProject,
   mapLookupBytesSaved
-} from "./token-goat-chunk-RTMVLHWX.mjs";
-import "./token-goat-chunk-L7H3U27L.mjs";
-import "./token-goat-chunk-RRNZMM3A.mjs";
-import "./token-goat-chunk-E5TK5DNO.mjs";
-import "./token-goat-chunk-ZER6EAXZ.mjs";
-import "./token-goat-chunk-EUSDXRXU.mjs";
-import "./token-goat-chunk-H5J3C56Q.mjs";
-import "./token-goat-chunk-TDUT2CL6.mjs";
+} from "./token-goat-chunk-FBNQNSJK.mjs";
+import "./token-goat-chunk-MNWKPRAL.mjs";
+import "./token-goat-chunk-67TQJ76B.mjs";
+import {
+  getDirtyPathsFor
+} from "./token-goat-chunk-H2PHHGM5.mjs";
+import "./token-goat-chunk-P4QMM4WK.mjs";
+import {
+  isWorkerRunning
+} from "./token-goat-chunk-5KDMCMF2.mjs";
+import "./token-goat-chunk-ATCPY7EQ.mjs";
+import "./token-goat-chunk-VPBBTSJR.mjs";
+import "./token-goat-chunk-Y776AENC.mjs";
+import "./token-goat-chunk-SJHWVNDQ.mjs";
+import "./token-goat-chunk-AFLYLHDH.mjs";
 import {
   claudeConfigDir
-} from "./token-goat-chunk-ONXH6NZ5.mjs";
-import "./token-goat-chunk-O6I2XU4P.mjs";
-import "./token-goat-chunk-D4ETHJD6.mjs";
-import "./token-goat-chunk-52NSDWYY.mjs";
-import "./token-goat-chunk-2WOUYWLM.mjs";
+} from "./token-goat-chunk-BPGCUMR7.mjs";
+import "./token-goat-chunk-C63JQV5K.mjs";
+import "./token-goat-chunk-JB6QN6VF.mjs";
+import {
+  embeddingsDepsAvailable
+} from "./token-goat-chunk-RHXKCZX3.mjs";
+import "./token-goat-chunk-EVMZJ27Z.mjs";
+import {
+  pathSuffixClause
+} from "./token-goat-chunk-HYBFA5X3.mjs";
+import "./token-goat-chunk-5Y6ZYL6U.mjs";
+import "./token-goat-chunk-ARDNEC2U.mjs";
 import {
   recordStat,
   savedTokensFromBytes
-} from "./token-goat-chunk-CIQ2FTY3.mjs";
-import "./token-goat-chunk-SE6E4BKJ.mjs";
-import "./token-goat-chunk-DNSPXQXQ.mjs";
-import "./token-goat-chunk-3BTK54F3.mjs";
-import "./token-goat-chunk-XTQAOTSO.mjs";
-import "./token-goat-chunk-AH6QILZM.mjs";
-import "./token-goat-chunk-PGTH2U4C.mjs";
-import {
-  checkEmbeddingPreflight,
-  embeddingsDepsAvailable
-} from "./token-goat-chunk-VMFWNHGR.mjs";
-import "./token-goat-chunk-435UQTKD.mjs";
+} from "./token-goat-chunk-3Z5S4KGM.mjs";
 import {
   getDb
-} from "./token-goat-chunk-7CPMDFGB.mjs";
+} from "./token-goat-chunk-VL3YIFHZ.mjs";
+import "./token-goat-chunk-XB5KKOCG.mjs";
+import "./token-goat-chunk-QSBRTGM2.mjs";
+import "./token-goat-chunk-N2NMER56.mjs";
+import "./token-goat-chunk-3BTK54F3.mjs";
+import "./token-goat-chunk-4FVIAHSI.mjs";
 import {
   loadConfig,
   resolveProjectRoot
-} from "./token-goat-chunk-TGOXNAHW.mjs";
-import "./token-goat-chunk-XB5KKOCG.mjs";
+} from "./token-goat-chunk-7IN2MKDS.mjs";
+import "./token-goat-chunk-U4N3BN2W.mjs";
 import "./token-goat-chunk-YZAAZU2S.mjs";
 import {
   envStrList
 } from "./token-goat-chunk-IVE6U7KV.mjs";
+import "./token-goat-chunk-XTQAOTSO.mjs";
+import "./token-goat-chunk-AH6QILZM.mjs";
+import "./token-goat-chunk-Y4AFKTHK.mjs";
 import {
   extractErrorMessage
-} from "./token-goat-chunk-XYWPOSCN.mjs";
+} from "./token-goat-chunk-GOLEOXZP.mjs";
 import {
   foldCaseForContainment
-} from "./token-goat-chunk-TCQANXYC.mjs";
+} from "./token-goat-chunk-AM5V6GSX.mjs";
 import {
   displaySafeJson,
   normalizePath
-} from "./token-goat-chunk-NMTKNYGF.mjs";
+} from "./token-goat-chunk-FNFBKLRD.mjs";
 import {
   ENV_KEYS,
   VERSION,
   dataDir,
   globalDbPath
-} from "./token-goat-chunk-MELOKFDJ.mjs";
-import "./token-goat-chunk-Y4AFKTHK.mjs";
-import "./token-goat-chunk-JTKCQMQA.mjs";
+} from "./token-goat-chunk-VES7EL7O.mjs";
+import "./token-goat-chunk-KWPNJBDH.mjs";
+import "./token-goat-chunk-HAVAOB3S.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
@@ -182,8 +203,86 @@ function realPathForContainment(p) {
 function forCompare(p) {
   return process.platform === "win32" ? foldCaseForContainment(p) : p;
 }
-function resolveToolRoot(projectRoot) {
-  const resolved = resolveProjectRoot(projectRoot !== void 0 ? { project: projectRoot } : {});
+function inferProjectRootFromTarget(target) {
+  const file = specFilePart(target);
+  if (!file) return null;
+  if (path.isAbsolute(file)) {
+    if (fs.existsSync(file)) {
+      try {
+        return resolveProjectRoot({ project: path.dirname(file) });
+      } catch {
+        return null;
+      }
+    }
+    return null;
+  }
+  try {
+    if (fs.existsSync(path.resolve(process.cwd(), file))) {
+      return null;
+    }
+  } catch {
+  }
+  const dbPath = globalDbPath();
+  if (fs.existsSync(dbPath)) {
+    try {
+      const db = getDb(dbPath);
+      const suffix = pathSuffixClause("path");
+      const rows = db.prepare(`SELECT path FROM files WHERE ${suffix.clause} ORDER BY length(path), path LIMIT 5`).all(...suffix.params(normalizePath(file)));
+      for (const row of rows) {
+        if (fs.existsSync(row.path)) {
+          return resolveProjectRoot({ project: path.dirname(row.path) });
+        }
+      }
+    } catch {
+    }
+  }
+  if (!file.includes("/") && !file.includes("\\") && !file.includes(".")) {
+    if (fs.existsSync(dbPath)) {
+      try {
+        const db = getDb(dbPath);
+        const rows = db.prepare(`SELECT file_path FROM symbols WHERE name = ? LIMIT 5`).all(file);
+        for (const row of rows) {
+          if (fs.existsSync(row.file_path)) {
+            return resolveProjectRoot({ project: path.dirname(row.file_path) });
+          }
+        }
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function rootHasIndexedFiles(root) {
+  const dbPath = globalDbPath();
+  if (!fs.existsSync(dbPath)) return false;
+  try {
+    const prefix = normalizePath(root).toLowerCase().replace(/\/+$/, "") + "/";
+    const row = getDb(dbPath).prepare(`SELECT 1 FROM files WHERE TG_LOWER(substr(path, 1, ?)) = ? LIMIT 1`).get(prefix.length, prefix);
+    return row !== void 0;
+  } catch {
+    return false;
+  }
+}
+function resolveToolRoot(projectRoot, candidateTargets) {
+  if (projectRoot !== void 0) {
+    const resolved2 = resolveProjectRoot({ project: projectRoot });
+    assertRootAllowed(resolved2);
+    return resolved2;
+  }
+  if (candidateTargets && candidateTargets.length > 0) {
+    for (const target of candidateTargets) {
+      if (!target) continue;
+      const inferred = inferProjectRootFromTarget(target);
+      if (inferred && rootHasIndexedFiles(inferred)) {
+        try {
+          assertRootAllowed(inferred);
+          return inferred;
+        } catch {
+        }
+      }
+    }
+  }
+  const resolved = resolveProjectRoot({});
   assertRootAllowed(resolved);
   return resolved;
 }
@@ -251,8 +350,9 @@ function pinsFor(abs, real, identity) {
 }
 function checkWithinProjectRoot(target, resolvedRoot) {
   const rootReal = realPathForContainment(resolvedRoot);
-  const abs = path.resolve(resolvedRoot, normalizePath(target));
-  const absRaw = path.resolve(resolvedRoot, target);
+  const spelled = expandSpecPath(target);
+  const abs = path.resolve(resolvedRoot, normalizePath(spelled));
+  const absRaw = path.resolve(resolvedRoot, spelled);
   const identity = identityOf(absRaw);
   const realNative = realPathForContainment(abs);
   if (rootReal === null) return { inside: false, reason: "unresolvable-root", pins: NO_CHECK_PINS };
@@ -277,19 +377,26 @@ function specFilePart(spec) {
   const colonIdx = findSpecSeparator(spec);
   return colonIdx === -1 ? spec : spec.slice(0, colonIdx);
 }
+function specFileCandidates(spec) {
+  const file = specFilePart(spec);
+  const out = [file];
+  for (let idx = file.indexOf("::"); idx !== -1; idx = file.indexOf("::", idx + 1)) if (idx > 0) out.push(file.slice(0, idx));
+  return out;
+}
 var NO_PINS = /* @__PURE__ */ new Map();
-function refusalText(file, resolvedRoot, reason) {
+function refusalText(file, resolvedRoot, reason, projectRootWasOmitted = false) {
   const escapeHatch = "Set mcp.confine_reads_to_project_root = false (or TOKEN_GOAT_MCP_CONFINE_READS=0) to allow cross-root reads.";
+  const omittedNote = projectRootWasOmitted ? ` Note: projectRoot was omitted and defaulted to server process cwd "${resolvedRoot}". Pass projectRoot: "<workspace-path>" if your target is in another directory.` : "";
   if (reason === "unresolvable-root") {
-    return `refused: the project root "${resolvedRoot}" could not be resolved, so no path can be confirmed to sit inside it. This is a broken workspace root -- an unmounted share, a deleted directory, or a permission change on a parent -- not a request to read outside the project.`;
+    return `refused: the project root "${resolvedRoot}" could not be resolved, so no path can be confirmed to sit inside it. This is a broken workspace root -- an unmounted share, a deleted directory, or a permission change on a parent -- not a request to read outside the project.` + omittedNote;
   }
   if (reason === "unresolvable-target") {
-    return `refused: "${file}" could not be resolved to a real location, so it cannot be confirmed to sit inside the project root. A symlink loop, a permission error on a parent directory, or a path past the operating system's length limit all produce this. The check fails closed rather than falling back to comparing the text of the path.`;
+    return `refused: "${file}" could not be resolved to a real location, so it cannot be confirmed to sit inside the project root. A symlink loop, a permission error on a parent directory, or a path past the operating system's length limit all produce this. The check fails closed rather than falling back to comparing the text of the path.` + omittedNote;
   }
   const rootScope = loadConfig().mcp.allowed_roots.length === 0 ? "Each call is confined to the projectRoot it names, and that root comes from the caller: set mcp.allowed_roots (or TOKEN_GOAT_MCP_ALLOWED_ROOTS) to pin which roots may be named at all." : "Each call is confined to the projectRoot it names, which must itself sit inside mcp.allowed_roots.";
-  return `refused: "${file}" is outside the project root "${resolvedRoot}". ${rootScope} ${escapeHatch}`;
+  return `refused: "${file}" is outside the project root "${resolvedRoot}". ${rootScope} ${escapeHatch}${omittedNote}`;
 }
-function confineTargets(targets, resolvedRoot, splitCommas = true) {
+function confineTargets(targets, resolvedRoot, splitCommas = true, projectRootWasOmitted = false) {
   if (!loadConfig(resolvedRoot).mcp.confine_reads_to_project_root) return { ok: true, targets, pins: NO_PINS };
   const allowedRoots = loadConfig().mcp.allowed_roots;
   const checked = [];
@@ -297,31 +404,32 @@ function confineTargets(targets, resolvedRoot, splitCommas = true) {
   for (const raw of targets) {
     const parts = splitCommas ? raw.split(",") : [raw];
     for (const part of parts) {
-      const file = specFilePart(part);
-      if (file === "") continue;
-      let check = checkWithinProjectRoot(file, resolvedRoot);
-      if (!check.inside) {
-        for (const allowed of allowedRoots) {
-          const altCheck = checkWithinProjectRoot(file, allowed);
-          if (altCheck.inside) {
-            check = altCheck;
-            break;
+      for (const file of specFileCandidates(part)) {
+        if (file === "") continue;
+        let check = checkWithinProjectRoot(file, resolvedRoot);
+        if (!check.inside) {
+          for (const allowed of allowedRoots) {
+            const altCheck = checkWithinProjectRoot(file, allowed);
+            if (altCheck.inside) {
+              check = altCheck;
+              break;
+            }
           }
         }
-      }
-      if (!check.inside) {
-        for (const aux of getStandardAuxiliaryRoots(file)) {
-          const auxCheck = checkWithinProjectRoot(file, aux);
-          if (auxCheck.inside) {
-            check = auxCheck;
-            break;
+        if (!check.inside) {
+          for (const aux of getStandardAuxiliaryRoots(file)) {
+            const auxCheck = checkWithinProjectRoot(file, aux);
+            if (auxCheck.inside) {
+              check = auxCheck;
+              break;
+            }
           }
         }
+        if (!check.inside) {
+          return { ok: false, refusal: toCallToolResult({ text: refusalText(file, resolvedRoot, check.reason, projectRootWasOmitted), code: 1 }) };
+        }
+        for (const [key, identity] of check.pins) pins.set(key, identity);
       }
-      if (!check.inside) {
-        return { ok: false, refusal: toCallToolResult({ text: refusalText(file, resolvedRoot, check.reason), code: 1 }) };
-      }
-      for (const [key, identity] of check.pins) pins.set(key, identity);
     }
     checked.push(splitCommas ? parts.join(",") : parts[0]);
   }
@@ -340,12 +448,28 @@ function withConfinedRead(pins, fn) {
     throw err;
   }
 }
+function noteOmittedProjectRoot(result, root, projectRootWasOmitted) {
+  if (!projectRootWasOmitted) return result;
+  if (!isIndexEmptyForProject(globalDbPath(), root)) return result;
+  const note = `
+(Note: projectRoot was omitted and defaulted to server cwd "${root}", which has no files indexed. Pass projectRoot: "<workspace-path>" to target your workspace.)`;
+  const contents = result.content;
+  if (!Array.isArray(contents)) return result;
+  for (const item of contents) {
+    if (item && typeof item === "object" && "text" in item && typeof item.text === "string") {
+      if (!item.text.includes("projectRoot was omitted")) {
+        item.text += note;
+      }
+    }
+  }
+  return result;
+}
 function mcpToolAllowlist() {
   const names = envStrList(ENV_KEYS.MCP_TOOLS, [], ",");
   return names.length === 0 ? null : new Set(names);
 }
 async function createMcpServer() {
-  const [{ McpServer }, { z }] = await Promise.all([import("./token-goat-chunk-6AK46ZT7.mjs"), import("./token-goat-chunk-CHLHM42P.mjs")]);
+  const [{ McpServer }, { z }] = await Promise.all([import("./token-goat-chunk-JN4XMLSD.mjs"), import("./token-goat-chunk-CHLHM42P.mjs")]);
   const server = new McpServer({ name: "token-goat", version: VERSION });
   const allowlist = mcpToolAllowlist();
   if (allowlist !== null) {
@@ -381,27 +505,32 @@ async function createMcpServer() {
     },
     (args) => {
       const { name, limit, file, kind, json, projectRoot } = args;
-      const root = resolveToolRoot(projectRoot);
+      const projectRootWasOmitted = projectRoot === void 0;
+      const root = resolveToolRoot(projectRoot, file ? [file] : name ? [name] : void 0);
       let confinedFile = file;
       let pins = NO_PINS;
       if (file !== void 0) {
-        const gate = confineTargets([file], root);
+        const gate = confineTargets([file], root, true, projectRootWasOmitted);
         if (!gate.ok) return gate.refusal;
         confinedFile = gate.targets[0];
         pins = gate.pins;
       }
-      return withConfinedRead(
-        pins,
-        () => toCallToolResult(
-          runSymbol({
-            name,
-            limit: limit ?? 20,
-            ...confinedFile !== void 0 ? { file: confinedFile } : {},
-            ...kind !== void 0 ? { kind } : {},
-            ...json === true ? { json: true } : {},
-            projectRoot: root
-          })
-        )
+      return noteOmittedProjectRoot(
+        withConfinedRead(
+          pins,
+          () => toCallToolResult(
+            runSymbol({
+              name,
+              limit: limit ?? 20,
+              ...confinedFile !== void 0 ? { file: confinedFile } : {},
+              ...kind !== void 0 ? { kind } : {},
+              ...json === true ? { json: true } : {},
+              projectRoot: root
+            })
+          )
+        ),
+        root,
+        projectRootWasOmitted
       );
     }
   );
@@ -421,20 +550,25 @@ async function createMcpServer() {
     },
     (args) => {
       const { spec, json, forceRefresh, stats, projectRoot } = args;
-      const root = resolveToolRoot(projectRoot);
-      const gate = confineTargets([spec], root);
+      const projectRootWasOmitted = projectRoot === void 0;
+      const root = resolveToolRoot(projectRoot, [spec]);
+      const gate = confineTargets([spec], root, true, projectRootWasOmitted);
       if (!gate.ok) return gate.refusal;
-      return withConfinedRead(
-        gate.pins,
-        () => toCallToolResult(
-          runRead({
-            spec: gate.targets[0],
-            ...json === true ? { json: true } : {},
-            ...forceRefresh === true ? { forceRefresh: true } : {},
-            ...stats === true ? { stats: true } : {},
-            projectRoot: root
-          })
-        )
+      return noteOmittedProjectRoot(
+        withConfinedRead(
+          gate.pins,
+          () => toCallToolResult(
+            runRead({
+              spec: gate.targets[0],
+              ...json === true ? { json: true } : {},
+              ...forceRefresh === true ? { forceRefresh: true } : {},
+              ...stats === true ? { stats: true } : {},
+              projectRoot: root
+            })
+          )
+        ),
+        root,
+        projectRootWasOmitted
       );
     }
   );
@@ -451,18 +585,23 @@ async function createMcpServer() {
     },
     (args) => {
       const { spec, json, projectRoot } = args;
-      const root = resolveToolRoot(projectRoot);
-      const gate = confineTargets([spec], root);
+      const projectRootWasOmitted = projectRoot === void 0;
+      const root = resolveToolRoot(projectRoot, [spec]);
+      const gate = confineTargets([spec], root, true, projectRootWasOmitted);
       if (!gate.ok) return gate.refusal;
-      return withConfinedRead(
-        gate.pins,
-        () => toCallToolResult(
-          runSection({
-            spec: gate.targets[0],
-            ...json === true ? { json: true } : {},
-            projectRoot: root
-          })
-        )
+      return noteOmittedProjectRoot(
+        withConfinedRead(
+          gate.pins,
+          () => toCallToolResult(
+            runSection({
+              spec: gate.targets[0],
+              ...json === true ? { json: true } : {},
+              projectRoot: root
+            })
+          )
+        ),
+        root,
+        projectRootWasOmitted
       );
     }
   );
@@ -482,21 +621,26 @@ async function createMcpServer() {
     },
     (args) => {
       const { file, json, minLines, forceRefresh, stats, projectRoot } = args;
-      const root = resolveToolRoot(projectRoot);
-      const gate = confineTargets([file], root);
+      const projectRootWasOmitted = projectRoot === void 0;
+      const root = resolveToolRoot(projectRoot, [file]);
+      const gate = confineTargets([file], root, true, projectRootWasOmitted);
       if (!gate.ok) return gate.refusal;
-      return withConfinedRead(
-        gate.pins,
-        () => toCallToolResult(
-          runSkeleton({
-            file: gate.targets[0],
-            ...json === true ? { json: true } : {},
-            ...minLines !== void 0 ? { minLines } : {},
-            ...forceRefresh === true ? { forceRefresh: true } : {},
-            ...stats === true ? { stats: true } : {},
-            projectRoot: root
-          })
-        )
+      return noteOmittedProjectRoot(
+        withConfinedRead(
+          gate.pins,
+          () => toCallToolResult(
+            runSkeleton({
+              file: gate.targets[0],
+              ...json === true ? { json: true } : {},
+              ...minLines !== void 0 ? { minLines } : {},
+              ...forceRefresh === true ? { forceRefresh: true } : {},
+              ...stats === true ? { stats: true } : {},
+              projectRoot: root
+            })
+          )
+        ),
+        root,
+        projectRootWasOmitted
       );
     }
   );
@@ -516,21 +660,26 @@ async function createMcpServer() {
     },
     (args) => {
       const { file, json, minLines, forceRefresh, stats, projectRoot } = args;
-      const root = resolveToolRoot(projectRoot);
-      const gate = confineTargets([file], root);
+      const projectRootWasOmitted = projectRoot === void 0;
+      const root = resolveToolRoot(projectRoot, [file]);
+      const gate = confineTargets([file], root, true, projectRootWasOmitted);
       if (!gate.ok) return gate.refusal;
-      return withConfinedRead(
-        gate.pins,
-        () => toCallToolResult(
-          runOutline({
-            file: gate.targets[0],
-            ...json === true ? { json: true } : {},
-            ...minLines !== void 0 ? { minLines } : {},
-            ...forceRefresh === true ? { forceRefresh: true } : {},
-            ...stats === true ? { stats: true } : {},
-            projectRoot: root
-          })
-        )
+      return noteOmittedProjectRoot(
+        withConfinedRead(
+          gate.pins,
+          () => toCallToolResult(
+            runOutline({
+              file: gate.targets[0],
+              ...json === true ? { json: true } : {},
+              ...minLines !== void 0 ? { minLines } : {},
+              ...forceRefresh === true ? { forceRefresh: true } : {},
+              ...stats === true ? { stats: true } : {},
+              projectRoot: root
+            })
+          )
+        ),
+        root,
+        projectRootWasOmitted
       );
     }
   );
@@ -607,7 +756,7 @@ async function createMcpServer() {
         }
       }
       const embeddingsEnabled = loadConfig(rootDir).indexing?.embeddings_enabled ?? true;
-      const preflight = await checkEmbeddingPreflight({
+      const preflight = await checkSemanticReadiness({
         projectRoot: rootDir,
         ...coverage !== void 0 ? { coverage } : {}
       });
@@ -647,9 +796,16 @@ async function createMcpServer() {
     },
     (args) => {
       const { spec, callers, limit, top, json, projectRoot } = args;
-      const root = resolveToolRoot(projectRoot);
-      const gate = confineTargets([spec], root);
+      const projectRootWasOmitted = projectRoot === void 0;
+      const root = resolveToolRoot(projectRoot, [spec]);
+      const gate = confineTargets([spec], root, true, projectRootWasOmitted);
       if (!gate.ok) return gate.refusal;
+      if (projectRootWasOmitted && isIndexEmptyForProject(globalDbPath(), root)) {
+        return toCallToolResult({
+          text: `Error: projectRoot was omitted and defaulted to server cwd "${root}", which has no files indexed. Pass projectRoot: "<workspace-path>" to target your workspace.`,
+          code: 1
+        });
+      }
       return withConfinedRead(
         gate.pins,
         () => toCallToolResultFromExitCode(
@@ -682,22 +838,27 @@ async function createMcpServer() {
     },
     (args) => {
       const { spec, limit, json, context, excludeTests, grep, projectRoot } = args;
-      const root = resolveToolRoot(projectRoot);
-      const gate = confineTargets([spec], root);
+      const projectRootWasOmitted = projectRoot === void 0;
+      const root = resolveToolRoot(projectRoot, [spec]);
+      const gate = confineTargets([spec], root, true, projectRootWasOmitted);
       if (!gate.ok) return gate.refusal;
-      return withConfinedRead(
-        gate.pins,
-        () => toCallToolResultFromExitCode(
-          () => runBrief({
-            spec: gate.targets[0],
-            ...json === true ? { json: true } : {},
-            ...limit !== void 0 ? { limit } : {},
-            ...context !== void 0 ? { context } : {},
-            ...excludeTests === true ? { excludeTests: true } : {},
-            ...grep !== void 0 ? { grep } : {},
-            projectRoot: root
-          })
-        )
+      return noteOmittedProjectRoot(
+        withConfinedRead(
+          gate.pins,
+          () => toCallToolResultFromExitCode(
+            () => runBrief({
+              spec: gate.targets[0],
+              ...json === true ? { json: true } : {},
+              ...limit !== void 0 ? { limit } : {},
+              ...context !== void 0 ? { context } : {},
+              ...excludeTests === true ? { excludeTests: true } : {},
+              ...grep !== void 0 ? { grep } : {},
+              projectRoot: root
+            })
+          )
+        ),
+        root,
+        projectRootWasOmitted
       );
     }
   );
@@ -713,7 +874,10 @@ async function createMcpServer() {
     },
     (args) => {
       const { compact, projectRoot } = args;
-      const map = buildProjectMap(resolveToolRoot(projectRoot), { compact: compact === true });
+      const root = resolveToolRoot(projectRoot);
+      const projectDenial = resolveProjectConfinement(root).denial;
+      if (projectDenial !== null) return toCallToolResult({ text: projectDenial, code: 1 });
+      const map = buildProjectMap(root, { compact: compact === true });
       const text = formatProjectMap(map, map.compact);
       const bytesSaved = mapLookupBytesSaved(map, text);
       recordStat("map_lookup", bytesSaved, savedTokensFromBytes(bytesSaved));
@@ -762,8 +926,9 @@ async function createMcpServer() {
     },
     (args) => {
       const { pattern, path: searchPath, maxLines, json, recursive, context, projectRoot } = args;
-      const root = resolveToolRoot(projectRoot);
-      const gate = confineTargets(searchPath === void 0 ? [root] : searchPath, root, false);
+      const projectRootWasOmitted = projectRoot === void 0;
+      const root = resolveToolRoot(projectRoot, searchPath);
+      const gate = confineTargets(searchPath === void 0 ? [root] : searchPath, root, false, projectRootWasOmitted);
       if (!gate.ok) return gate.refusal;
       const confinedPath = searchPath === void 0 ? void 0 : [...gate.targets];
       return withConfinedRead(
@@ -795,8 +960,9 @@ async function createMcpServer() {
     },
     (args) => {
       const { file, json, projectRoot } = args;
-      const root = resolveToolRoot(projectRoot);
-      const gate = confineTargets([file], root);
+      const projectRootWasOmitted = projectRoot === void 0;
+      const root = resolveToolRoot(projectRoot, [file]);
+      const gate = confineTargets([file], root, true, projectRootWasOmitted);
       if (!gate.ok) return gate.refusal;
       return withConfinedRead(
         gate.pins,
@@ -819,8 +985,9 @@ async function createMcpServer() {
     },
     (args) => {
       const { file, json, projectRoot } = args;
-      const root = resolveToolRoot(projectRoot);
-      const gate = confineTargets([file], root);
+      const projectRootWasOmitted = projectRoot === void 0;
+      const root = resolveToolRoot(projectRoot, [file]);
+      const gate = confineTargets([file], root, true, projectRootWasOmitted);
       if (!gate.ok) return gate.refusal;
       return withConfinedRead(
         gate.pins,
@@ -897,5 +1064,6 @@ async function createMcpServer() {
 export {
   checkWithinProjectRoot,
   createMcpServer,
+  inferProjectRootFromTarget,
   mcpToolAllowlist
 };