toolfunnel 0.7.0 → 0.8.0

package/src/mcp/aggregator.js

@@ -1,1674 +1,2248 @@
-'use strict';
-
-/**
- * aggregator.js - the upstream-MCP connection + curated-expose layer.
- *
- * The aggregator is the bridge between the persisted MCP config (src/mcp/expose-store.js)
- * and the live upstream MCP servers (src/mcp/mcp-client.js). It:
- *
- *   1. CONNECTS one McpClient per ENABLED upstream in the ExposeStore (connectAll),
- *      caching the connected client + its discovered tools. A failed upstream never
- *      sinks the others - failures are collected, not thrown.
- *   2. DISCOVERS an upstream's tool surface on demand (discover) - what the MCP
- *      Manager UI's 'discover' button calls.
- *   3. Computes the CURATED-DIRECT tool definitions to advertise downstream
- *      (exposedToolDefinitions) - only for ENABLED expose[] entries whose upstream
- *      is connected, enabled, AND actually advertises the named tool. Each definition is
- *      renamed to its downstream `as` name (what the CLI / PreToolUse matchers see).
- *   4. RESOLVES a downstream call back to its upstream client + real tool name
- *      (resolveExposedExecution) - the seam the MCP server's curated-direct call
- *      path uses to actually execute, AFTER the hook gate has run.
- *
- * Decoupling note: downstream the CLI sees the renamed `as` tool; upstream we call
- * the REAL tool name. resolveExposedExecution carries BOTH so the gate (PreToolUse)
- * matches on the downstream name while execution hits the real upstream.
- *
- * SAFETY CONTRACT (mirrors expose-store.js / mcp-client.js):
- *   - connectAll / discover / closeAll NEVER throw. connectAll collects per-upstream
- *     failures into failed[]; a dead/misconfigured upstream cannot crash the server
- *     start. closeAll is idempotent and tears down every cached client.
- *   - The DEFAULT clientFactory enforces the HARD ISOLATION rule: a vendored upstream
- *     may only reference CODE/FILES inside the gateway root. The
- *     guard is applied to the ARGS (the script path, db files, ... that the interpreter
- *     is pointed at): any arg that is an absolute path, or that looks like a file path
- *     (contains a path separator), MUST resolve inside gatewayRoot - otherwise the factory
- *     throws and connectAll records the upstream in failed[]. The COMMAND slot is the
- *     interpreter/executable (node, npx, or an absolute path to a node binary that by
- *     definition lives OUTSIDE the project, e.g. process.execPath / a system node.exe)
- *     and is therefore NOT subject to the in-sandbox requirement - bare commands AND an
- *     absolute interpreter path are both allowed. Isolation is about WHAT CODE runs in
- *     the spawned process, not which interpreter binary runs it; the args are that code.
- *     This is what stops a config from pointing at a live `.mcp.json` server's script
- *     outside the sandbox while still letting the system node interpreter spawn it.
- *
- * CommonJS only. Node built-ins only. No new npm dependency. No @modelcontextprotocol/sdk.
- */
-
-const path = require('node:path');
-
-const { McpClient, PROTOCOL_VERSION: LEGACY_UPSTREAM_VERSION } = require('./mcp-client');
-const logger = require('../core/logger');
-
-// The sandbox root = the CONFIG HOME (TOOLFUNNEL_HOME / --config-dir; defaults to the package
-// root - see src/core/config-home.js). Used as the isolation boundary the default clientFactory
-// enforces: a pack's path-shaped upstream args live under the home, so the home is the boundary.
-// A caller may override via opts.gatewayRoot for tests.
-const { resolveConfigHome } = require('../core/config-home');
-const DEFAULT_ROOT = resolveConfigHome();
-
-/** True for a non-empty string. */
-function isNonEmptyString(v) {
-  return typeof v === 'string' && v.length > 0;
-}
-
-/**
- * Does this argv token LOOK like a file path? An absolute path (path.isAbsolute) or
- * any token containing a path separator ('/' or '\\') is treated as a path reference
- * and must be confined to gatewayRoot. A bare token like 'node', 'npx', 'server' or a flag
- * like '--port' is NOT a path and is always allowed.
- * @param {string} arg
- * @returns {boolean}
- */
-function looksLikePath(arg) {
-  if (!isNonEmptyString(arg)) return false;
-  if (path.isAbsolute(arg)) return true;
-  // win32 DRIVE-RELATIVE form ('C:foo.js') - path.win32.isAbsolute() is false for it and it holds
-  // no separator, so without this it looked like a bare token and skipped the guard entirely.
-  if (/^[A-Za-z]:/.test(arg)) return true;
-  return arg.indexOf('/') !== -1 || arg.indexOf('\\') !== -1;
-}
-
-/**
- * The path-shaped candidates inside a single argv token. A runtime option in `--flag=value` form
- * (node's --require=, --import=, --experimental-loader=, and their Deno/Bun kin) interprets only
- * the part AFTER the first '=' as a path. The whole token '--require=../x.js' carries no '..'
- * segment of its own, so a check of the token alone judges it inside the root while the child
- * resolves the value and leaves it. So the value after the first '=' is returned as its own
- * candidate, checked alongside the whole token. A non-path value ('--port=8080') simply fails
- * looksLikePath() and is ignored; an inside value still resolves inside and passes.
- * @param {string} arg
- * @returns {string[]}
- */
-function argPathCandidates(arg) {
-  if (!isNonEmptyString(arg)) return [];
-  const out = [arg];
-  const eq = arg.indexOf('=');
-  if (eq !== -1 && eq < arg.length - 1) out.push(arg.slice(eq + 1));
-  return out;
-}
-
-/**
- * Is this a win32 DRIVE-RELATIVE reference ('C:foo', drive letter + colon + no separator)?
- * It resolves against the CHILD's per-drive current directory - a base the guard cannot pin -
- * so it can never be PROVEN inside the root: path.resolve(root, 'C:x') judges it optimistically
- * when root shares the drive. There is no legitimate in-sandbox use (an inside path can always
- * be written absolutely or plainly relative), so it is refused outright wherever paths are
- * guarded. Checked on every platform: a config is portable and gets run somewhere else.
- * @param {string} t
- * @returns {boolean}
- */
-function isDriveRelative(t) {
-  return /^[A-Za-z]:(?![\\/])/.test(t);
-}
-
-// Environment variables that make a child load code, whatever its args say (0.7.0). Two classes with two rules. All platforms' vars are checked on all platforms because
-// a config is portable and gets run somewhere else, and keys are compared CASE-INSENSITIVELY
-// everywhere because Windows env lookup is case-insensitive - `node_options` reaches the child
-// exactly as `NODE_OPTIONS` does, so an exact-case allowlist was a one-character bypass there.
-//
-// OPTION-STRING vars are a mini command line in the runtime's OWN grammar: quoting, `=` forms,
-// `file:`/`data:` URLs, inspector flags. A path-shaped guard cannot verify them (quoted
-// values, URL specifiers and a bare `--inspect` all defeat any tokeniser written here),
-// and a guard that cannot verify must refuse, not guess. Refused outright in funnel mode; the
-// operator's deliberate opt-out is `allowCodeLoadingEnv: true` on the upstream entry (the
-// legacyPin pattern - off by default, visible in config, warned when it excuses something).
-const CODE_OPT_ENV = [
-  'NODE_OPTIONS',
-  'JAVA_TOOL_OPTIONS',
-  '_JAVA_OPTIONS',
-  'PERL5OPT',
-  'RUBYOPT',
-];
-// PATH / PATH-LIST vars name locations directly and ARE checkable: extract pieces, judge each
-// against the root. This list is a FLOOR, not a boundary - runtimes keep minting code-loading
-// vars, and the `command` slot is arbitrary by design (see SECURITY.md: the guard is a tripwire
-// for out-of-root references in an auditable config home, not a sandbox against an untrusted
-// pack author).
-const CODE_PATH_ENV = [
-  'NODE_PATH',
-  'NODE_REPL_EXTERNAL_MODULE',
-  'LD_PRELOAD',
-  'LD_LIBRARY_PATH',
-  'LD_AUDIT',
-  'DYLD_INSERT_LIBRARIES',
-  'DYLD_LIBRARY_PATH',
-  'DYLD_FRAMEWORK_PATH',
-  'PYTHONPATH',
-  'PYTHONSTARTUP',
-  'PYTHONHOME',
-  'PYTHONEXECUTABLE',
-  'PERL5LIB',
-  'RUBYLIB',
-  'GEM_PATH',
-  'CLASSPATH',
-  'BASH_ENV',
-  'ENV',
-  'DOTNET_STARTUP_HOOKS',
-  'CORECLR_PROFILER_PATH',
-];
-
-/**
- * Is `target` inside `root` (or equal to it)? Compares fully-resolved, normalised
- * absolute paths. A relative `target` is resolved AGAINST root (so 'vendor/x/server.js'
- * checks the in-sandbox location). Returns false for anything that escapes root via
- * '..' or an absolute path elsewhere on disk.
- * @param {string} root    absolute sandbox root
- * @param {string} target  path token (absolute or relative)
- * @returns {boolean}
- */
-function isInside(root, target) {
-  const resolvedRoot = path.resolve(root);
-  // An absolute target is checked as-is; a relative one is resolved within the root so
-  // a vendored relative path ('vendor/foo/server.js') is judged at its in-sandbox spot.
-  const resolvedTarget = path.isAbsolute(target)
-    ? path.resolve(target)
-    : path.resolve(resolvedRoot, target);
-  const rel = path.relative(resolvedRoot, resolvedTarget);
-  // Inside iff the relative path neither starts with '..' nor is itself absolute
-  // (an absolute `rel` happens on win32 across drive letters). '' (equal) counts as inside.
-  return rel === '' || (!rel.startsWith('..' + path.sep) && rel !== '..' && !path.isAbsolute(rel));
-}
-
-/**
- * The DEFAULT clientFactory. Constructs a McpClient for an upstream entry AFTER
- * enforcing the isolation guard on the ARGS: every arg that looks like a file path
- * (an absolute path, or any token containing a path separator) must resolve inside
- * `gatewayRoot`. Throws a clear 'isolation: ...' error otherwise - connectAll catches that
- * into failed[].
- *
- * The COMMAND slot is intentionally NOT guarded: it names the interpreter/executable
- * (e.g. 'node', 'npx', or an absolute path to a node binary such as process.execPath /
- * a system node.exe) which by definition lives OUTSIDE the project. Isolation is about
- * WHAT CODE the spawned process runs - that is the args (the server script + any data
- * files it loads) - not which interpreter binary launches it. Guarding the command too
- * would wrongly reject every vendored upstream the moment it is run by the system node.
- *
- * @param {object} upstream  a normalised ExposeStore upstream { id, command, args, env, ... }
- * @param {string} gatewayRoot    the sandbox root the upstream's path-shaped ARGS must stay inside
- * @returns {McpClient}
- */
-function defaultClientFactory(upstream, gatewayRoot, onClose, allowOutsidePaths, clientInfo, eraHint) {
-  const id = isNonEmptyString(upstream && upstream.id) ? upstream.id : '(unknown)';
-  const args = Array.isArray(upstream && upstream.args) ? upstream.args : [];
-  // The caller passes TRUE for the wrapped upstream; the upstream may also claim the exemption for
-  // itself in config. Either way it is decided HERE, per upstream, from THIS upstream's own entry -
-  // there is no shared or latched state, so one server's opt-out can never relax another's guard.
-  const outsideAllowed = allowOutsidePaths === true || (upstream && upstream.allowOutsidePaths === true);
-  const byConfig = allowOutsidePaths !== true && outsideAllowed;
-
-  // Guard every field that decides WHAT CODE the spawned process runs: path-shaped args, the cwd
-  // they resolve against, and the env vars that load code irrespective of args. The command
-  // (interpreter) is NOT guarded - see the function doc: it is the executable, not the code.
-  // allowOutsidePaths: TRUE only for the currently-WRAPPED upstream (transparent-wrapper mode -
-  // the operator explicitly made this server the entire surface, e.g. server-filesystem serving
-  // a documents folder). Warn instead of refuse; funnel-mode upstreams keep the hard guard.
-  // ONE notice per CLASS, not per upstream: `warnedPath` covers the path class (args + cwd); the
-  // env section below keeps its OWN flag. A single shared flag let the first path finding consume
-  // the only slot, so an env finding - the class that loads code - was excused in total silence,
-  // precisely for the operator who opted out and most needs the audit trail.
-  let warnedPath = false;
-  const refuse = (what) => {
-    if (outsideAllowed === true) {
-      if (!warnedPath) {
-        warnedPath = true;
-        // Name the REAL reason. Reporting a config opt-out as transparent-wrapper mode would put a
-        // false explanation in the operator's log for the one event they most need to trace.
-        process.stderr.write(byConfig
-          ? `[toolfunnel] isolation: upstream "${id}" reaches outside the gateway root (${what}) - ` +
-            `permitted because its config sets allowOutsidePaths:true. This upstream is NOT isolated ` +
-            `to the config home; every tool it serves runs with that exemption. Remove the flag to ` +
-            `restore the guard, or gate the tools with a PreToolUse hook.\n`
-          : `[toolfunnel] isolation: WRAPPED upstream "${id}" reaches outside the gateway root ` +
-            `(${what}) - permitted in transparent-wrapper mode. To restrict what it can do post-wrap, see the ` +
-            `manual's "Wrapping & security" section (PreToolUse gate, per-tool enabled:false).\n`);
-      }
-      return false; // permitted under the wrap, or by this upstream's own opt-out
-    }
-    throw new Error(`isolation: upstream ${id} references a path outside the gateway root`);
-  };
-
-  for (const arg of args) {
-    // Check the whole token AND the value after a '=' (the --flag=value form the child splits) -
-    // either escaping the root refuses the arg. The notice still names the whole token.
-    const escapes = argPathCandidates(arg).some(
-      (cand) => looksLikePath(cand) && (isDriveRelative(cand) || !isInside(gatewayRoot, cand))
-    );
-    if (escapes) {
-      if (refuse(`arg "${arg}"`) === false) break; // one notice covers the path class
-    }
-  }
-
-  // cwd - the SPAWN BASE (0.7.0). Guarded because it decides where a bare, separator-free arg like
-  // 'server.js' actually resolves: looksLikePath() is false for such a token so the loop above
-  // never sees it, while the child resolves it against cwd. Until 0.7.0 the comment below claimed
-  // guard-base and spawn-base "agree by construction" - true only while cwd was unset.
-  // Drive-relative gets the same outright refusal as everywhere else: 'C:denied' resolves
-  // against the child's per-drive current directory, and isInside() judging it against the root
-  // is optimistic-and-wrong whenever the root shares the drive.
-  if (isNonEmptyString(upstream && upstream.cwd)
-    && (isDriveRelative(upstream.cwd) || !isInside(gatewayRoot, upstream.cwd))) {
-    refuse(`cwd "${upstream.cwd}"`);
-  }
-
-  // env - CODE-LOADING variables (0.7.0). A value in any of these loads code
-  // into the child however clean the args are (reachable in-band: tf_mcp_add forwards env
-  // verbatim). Keys are matched CASE-INSENSITIVELY on every platform - Windows env lookup is
-  // case-insensitive, so `node_options` is `NODE_OPTIONS` to the child - and every platform's
-  // variable is checked on every platform: a pack authored on Linux gets run on Windows and back.
-  //
-  // `allowCodeLoadingEnv: true` on the upstream entry is the operator's explicit opt-out for the
-  // whole class: the finding downgrades to a once-per-upstream stderr warning naming the flag.
-  const envObj = upstream && typeof upstream.env === 'object' && upstream.env ? upstream.env : null;
-  if (envObj) {
-    const envAllowed = (upstream && upstream.allowCodeLoadingEnv === true);
-    // The env class's OWN notice flag - deliberately independent of `warnedPath` (see above).
-    let warnedEnv = false;
-    const envNotice = (why) => {
-      if (warnedEnv) return;
-      warnedEnv = true;
-      process.stderr.write(`[toolfunnel] isolation: upstream "${id}" sets code-loading env ${why}`);
-    };
-    // Which flag excuses an env finding depends on its KIND:
-    //   'opt'  - option-string vars (NODE_OPTIONS et al.): not path-checkable, so ONLY the class's
-    //            own flag (allowCodeLoadingEnv) or the WRAP excuses them. allowOutsidePaths does
-    //            NOT: it is documented (expose-store) as args/cwd/path-list scope, and letting the
-    //            path flag silently disarm this separately-audited class was a cross-flag grant
-    //            the operator never made.
-    //   'path' - path-list vars (NODE_PATH et al.): inside the path flag's documented scope, so
-    //            wrap, allowCodeLoadingEnv or allowOutsidePaths excuses - each loudly, by name.
-    const refuseEnv = (what, kind) => {
-      if (envAllowed) {
-        envNotice(`(${what}) - permitted by allowCodeLoadingEnv:true on this upstream. Remove the ` +
-          'flag to restore the refusal.\n');
-        return false;
-      }
-      if (allowOutsidePaths === true) {
-        envNotice(`(${what}) - permitted in transparent-wrapper mode (this upstream IS the ` +
-          'surface). To restrict it post-wrap, see the manual\'s "Wrapping & security" section.\n');
-        return false;
-      }
-      if (kind === 'path' && outsideAllowed === true) {
-        envNotice(`(${what}) - permitted because its config sets allowOutsidePaths:true ` +
-          '(path-list env is within that flag\'s scope). Remove the flag to restore the guard.\n');
-        return false;
-      }
-      throw new Error(`isolation: upstream ${id} sets code-loading env (${what})`);
-    };
-    // Enumerate EXACTLY as child_process does: `for...in`, which walks own AND INHERITED keys
-    // (node's normalizeSpawnArguments: "Prototype values are intentionally included"). An
-    // Object.keys() walk was blind to a `__proto__` carrier - JSON.parse makes `__proto__` an OWN
-    // data property, spread preserves it, and the client's Object.assign merge then uses [[Set]],
-    // firing the Object.prototype.__proto__ setter and installing the payload as the merged env's
-    // PROTOTYPE: invisible to Object.keys, delivered to the child.
-    for (const key in envObj) {
-      const upper = String(key).toUpperCase();
-      // A `__proto__` key is refused OUTRIGHT, whatever it carries. It is not an env var: it is
-      // the carrier that turns into the merged env's PROTOTYPE at the client's Object.assign, and
-      // from there into real variables for the child (for..in). Nothing legitimate needs it.
-      if (key === '__proto__') {
-        refuseEnv('env "__proto__" (a prototype carrier, not an environment variable)', 'opt');
-        continue;
-      }
-      // Judge the value as the spawn will USE it, not as it was authored. node builds each pair as
-      // `${key}=${value}`, so a one-element array becomes its element verbatim and a number becomes
-      // its digits. Testing isNonEmptyString FIRST let every non-string value skip both lists -
-      // again the guard reading a different representation than the consumer. A value that cannot
-      // even be coerced is unverifiable in a code-loading slot, so it is refused rather than
-      // skipped (the same rule the option-string class already follows).
-      const rawValue = envObj[key];
-      if (rawValue === undefined || rawValue === null) continue;
-      let raw;
-      try {
-        raw = typeof rawValue === 'string' ? rawValue : String(rawValue);
-      } catch (_e) {
-        if (CODE_OPT_ENV.includes(upper) || CODE_PATH_ENV.includes(upper)) {
-          refuseEnv(`env ${key} (value cannot be read as a string, so it cannot be verified)`,
-            CODE_OPT_ENV.includes(upper) ? 'opt' : 'path');
-        }
-        continue;
-      }
-      if (raw.length === 0) continue;
-      if (CODE_OPT_ENV.includes(upper)) {
-        // Not path-checkable (see the class doc above the lists) - the VALUE is irrelevant.
-        if (refuseEnv(`env ${key} (option-string vars are not path-checkable)`, 'opt') === false) continue;
-        continue;
-      }
-      if (!CODE_PATH_ENV.includes(upper)) continue;
-      // Path / path-list value: pieces are EXTRACTED (not split) so a drive-lettered piece
-      // ('C:\x', 'C:x') survives whole on every platform - splitting 'C:relative\denied' on ':'
-      // yields fragments that resolve inside the root while the child resolves the real path
-      // outside it. Both ';' and ':' end a piece everywhere (a POSIX filename containing ';'
-      // may be shredded and falsely refused - conservative, never a false allow).
-      const parts = (raw.match(/[A-Za-z]:[^;:]*|[^;:]+/g) || []).filter((t) => t.length > 0);
-      if (parts.length === 0) continue;
-      if (parts.some((t) => isDriveRelative(t) || !isInside(gatewayRoot, t))) {
-        refuseEnv(`env ${key}="${raw}"`, 'path');
-      }
-    }
-  }
-
-  return new McpClient({
-    id: upstream.id,
-    command: upstream.command,
-    args: upstream.args,
-    env: upstream.env,
-    // Child cwd from config - the wrap era-probe reads it too; it never survived the store
-    // before. Default = the CONFIG HOME (gatewayRoot), NOT the gateway's process cwd:
-    // the isolation guard above resolves relative args against the home, so the spawn must
-    // resolve them against the SAME base or a guard-passing relative path fails to spawn
-    // whenever --config-dir differs from the launch directory (guard-base and spawn-base agree
-    // by construction).
-    cwd: isNonEmptyString(upstream && upstream.cwd) ? upstream.cwd : gatewayRoot,
-    // Per-upstream `timeoutMs` config -> the client's PAYLOAD window (tools/call | prompts/get |
-    // resources/read; default 120 s).
-    toolTimeoutMs: Number.isFinite(upstream && upstream.timeoutMs) && upstream.timeoutMs > 0
-      ? upstream.timeoutMs : undefined,
-    // Per-upstream `requestTimeoutMs` config -> the CONTROL window (handshake/list/discover/
-    // ping; default 10 s = the dead-upstream detector). Opt-in for slow-boot servers that
-    // cannot answer initialize inside 10 s - without it they can never be attached at all.
-    requestTimeoutMs: Number.isFinite(upstream && upstream.requestTimeoutMs) && upstream.requestTimeoutMs > 0
-      ? upstream.requestTimeoutMs : undefined,
-    // legacyPin FORCES the legacy era: skip the modern server/discover probe and go straight to
-    // the initialize handshake, so a pinned upstream is genuinely spoken to as 2024-11-05 (the pin
-    // is an ENFORCED policy, not just a warning). Off by default.
-    forceLegacy: !!(upstream && upstream.legacyPin === true),
-    // modernOnly (legacyPin's mirror): refuse the legacy fallback - a non-modern upstream fails
-    // the connect with a clear error instead of negotiating down. Store validation refuses the
-    // legacyPin+modernOnly contradiction before it ever reaches here.
-    modernOnly: !!(upstream && upstream.modernOnly === true),
-    // The aggregator's era memo (last successful connect): 'legacy' lets a reconnect skip the
-    // server/discover probe. The client ignores it under modernOnly; the aggregator clears it on
-    // a failed connect and on an explicit reconnect().
-    eraHint: eraHint === 'legacy' ? 'legacy' : undefined,
-    // clientInfo: the identity presented to this upstream (identity mirroring / configured
-    // identity). null/undefined -> McpClient's built-in default, wire behaviour unchanged.
-    clientInfo: clientInfo || undefined,
-    onClose, // unexpected death -> the aggregator schedules a background reconnect
-  });
-}
-
-/**
- * Aggregator - owns the live upstream connections and the curated-expose computation.
- *
- * Lifecycle: `new Aggregator({ store, gatewayRoot, clientFactory })`
- *            -> `await connectAll()` (or `await discover(id)` lazily)
- *            -> `exposedToolDefinitions()` / `resolveExposedExecution(name, args)`
- *            -> `await closeAll()` (idempotent).
- */
-class Aggregator {
-  /**
-   * @param {object} opts
-   * @param {object} opts.store            an ExposeStore (the on-disk MCP config).
-   * @param {string} [opts.gatewayRoot]         sandbox root for the isolation guard (default: the gateway root).
-   * @param {Function} [opts.clientFactory] (upstreamEntry, gatewayRoot) -> McpClient. Default enforces isolation.
-   * @param {Function} [opts.wrapTargetProvider] () -> the currently-WRAPPED upstream id (or null).
-   *        Read fresh at each connect: the wrapped upstream is EXEMPT from the path-isolation
-   *        guard (by design - a wrap is an explicit "this server IS my whole
-   *        surface" declaration, so ToolFunnel is a transparent wrapper in that incidence; the
-   *        operator gets a strong warning + post-wrap restriction docs instead of a refusal).
-   *        Funnel-mode upstreams keep the guard unchanged.
-   * @param {Function} [opts.clientInfoProvider] (upstreamId) -> {name, version}|null. The identity
-   *        to PRESENT to that upstream. Read fresh at each connect (same pattern as the wrap-target
-   *        provider) so a mirror captured after boot is honoured by the next (re)connect. null ->
-   *        McpClient's built-in default.
-   */
-  constructor({ store, gatewayRoot, clientFactory, onToolsChanged, wrapTargetProvider, clientInfoProvider } = {}) {
-    if (!store || typeof store !== 'object') {
-      throw new Error('Aggregator: a `store` (ExposeStore) is required');
-    }
-    this._store = store;
-    this._gatewayRoot = isNonEmptyString(gatewayRoot) ? gatewayRoot : DEFAULT_ROOT;
-    // Called when the LIVE tool set changes OUT OF BAND (a background reconnect recovers or finally
-    // loses an upstream) so the transport can emit notifications/tools/list_changed. Default no-op;
-    // the server wires it to emitToolsListChanged(send). Settable so reloadExpose can re-wire the
-    // new instance.
-    this.onToolsChanged = typeof onToolsChanged === 'function' ? onToolsChanged : () => {};
-    // Called with (upstreamId, notification) for each server-initiated CHANGE notification from an
-    // upstream (resources/updated, resources/list_changed, prompts/list_changed, tools/list_changed)
-    // so the transport can bridge it to a modern client's subscriptions/listen stream. Default no-op;
-    // the server/http host wires it. Settable so reloadExpose can re-wire the new instance.
-    this.onUpstreamNotification = () => {};
-    // Called with (upstreamId, requestMsg, client) for each SERVER-INITIATED REQUEST from an
-    // upstream (elicitation/create, sampling/createMessage, roots/list - the elicitation bridge). The handler
-    // owns answering via client.respondToServer(Error). Default: -32601, so an unwired build
-    // never leaves an upstream holding an open request. Settable; reloadExpose carries it over.
-    this.onUpstreamServerRequest = (uid, msg, client) => {
-      try { client.respondToServerError(msg.id, -32601, 'Method not found: ' + msg.method); } catch (_e) { /* never throw */ }
-    };
-    // When a passthrough WRAP is active, the wrapped upstream's request-scoped chatter
-    // (notifications/message, notifications/progress) also bridges - connected directly, the
-    // client would receive it. The server keeps this current with the live wrap state.
-    this.wrapChatterUpstream = null;
-    this._wrapTargetProvider = typeof wrapTargetProvider === 'function' ? wrapTargetProvider : null;
-    this._clientInfoProvider = typeof clientInfoProvider === 'function' ? clientInfoProvider : null;
-    // The factory receives (upstream, gatewayRoot, onClose). A caller-supplied factory may ignore the
-    // extra args; the default uses gatewayRoot for isolation and onClose for death-driven reconnect.
-    // The wrap-target check runs PER CONNECT (fresh provider read), so a wrap set after boot is
-    // honoured by the next connect attempt.
-    this._clientFactory =
-      typeof clientFactory === 'function'
-        ? (upstream, onClose) => clientFactory(upstream, this._gatewayRoot, onClose)
-        : (upstream, onClose) => defaultClientFactory(upstream, this._gatewayRoot, onClose,
-            this._isWrapTarget(upstream && upstream.id),
-            this._readClientInfo(upstream && upstream.id),
-            this._eraMemo.get(upstream && upstream.id));
-
-    /** @type {Map<string, object>} upstreamId -> connected McpClient */
-    this._clients = new Map();
-    /** @type {Map<string, Array>} upstreamId -> discovered tool defs [{name,description,inputSchema}] */
-    this._tools = new Map();
-    /** @type {Map<string, Promise>} upstreamId -> in-flight connect promise (race guard for ensureConnected) */
-    this._connecting = new Map();
-    /** @type {Set<string>} agreed resource-subscription URIs - replayed onto every (re)connect
-     * of a subscribe-capable legacy upstream so the channel survives reconnects */
-    this._subscribedUris = new Set();
-    /** @type {Map<string, number>} uri -> LISTEN-owned refcount. subscribeResources
-     * increments; releaseResources decrements and unsubscribes upstream at zero. The wrap-forward
-     * recording (a client's own resources/subscribe) writes the Set directly and is NOT counted
-     * here - the client manages that lifetime itself. */
-    this._subscribedRefs = new Map();
-    /** @type {Map<string, any>} upstreamId -> pending background-reconnect timer (one per upstream) */
-    this._reconnectTimers = new Map();
-    /** @type {Set<string>} upstreams whose reconnect ATTEMPT is currently executing (between the timer
-     * firing - which deletes its own entry from _reconnectTimers - and the attempt settling). While an
-     * id is in here, _handleUpstreamDown must NOT seed a fresh attempt-0: the in-flight attempt's own
-     * catch owns the next backoff step. Without this, a death DURING an attempt's tools/list re-seeds
-     * the 1s floor and the one-timer guard then swallows the escalation - a permanent 1s respawn loop. */
-    this._reconnecting = new Set();
-    /** @type {Map<string, 'modern'|'legacy'>} upstreamId -> era negotiated at the LAST successful
-     * connect. A death-driven reconnect passes it to the client as eraHint so a legacy upstream
-     * skips the server/discover probe (worst case ~3s against a server that silently drops unknown
-     * methods) instead of re-paying it on every respawn. Lifecycle: SET on a successful connect,
-     * CLEARED when a connect fails (the hinted attempt may be why - the next retry re-negotiates
-     * in full, so an upstream upgraded across a restart self-heals) and by an explicit reconnect()
-     * (a manual kick deliberately re-negotiates). A config reload swaps in a fresh Aggregator, so
-     * a changed entry never inherits a stale memo. */
-    this._eraMemo = new Map();
-    /** Set true by closeAll(). A torn-down aggregator (e.g. swapped out by reloadExpose) must NEVER
-     *  (re)connect - a captured execute thunk holding this instance would otherwise spawn an orphan
-     *  upstream child on it that nothing ever closes. ensureConnected/connectAll check this. */
-    this._closed = false;
-  }
-
-  /**
-   * Connect every ENABLED upstream in the store, caching each connected client and its
-   * discovered tools. NEVER throws - a per-upstream failure (isolation guard, spawn
-   * failure, handshake timeout, listTools failure) is collected into failed[]. An
-   * upstream already connected (cached) is treated as connected without reconnecting.
-   *
-   * @returns {Promise<{ connected: string[], failed: Array<{id:string, error:string}> }>}
-   */
-  async connectAll() {
-    const connected = [];
-    const failed = [];
-    if (this._closed) return { connected, failed }; // a closed (torn-down) aggregator never connects
-
-    let upstreams;
-    try {
-      upstreams = this._store.listUpstreams();
-    } catch (err) {
-      // listUpstreams() shouldn't throw (it clones), but never let it sink connectAll.
-      return { connected, failed: [{ id: '(store)', error: errMsg(err) }] };
-    }
-
-    for (const upstream of upstreams) {
-      if (!upstream || upstream.enabled !== true) continue; // only ENABLED upstreams
-
-      const id = upstream.id;
-      if (this._clients.has(id)) {
-        // Already connected this session - keep it; don't double-spawn.
-        connected.push(id);
-        continue;
-      }
-
-      try {
-        await this._connectOne(upstream);
-        connected.push(id);
-      } catch (err) {
-        // Clean up any half-built client so a failure leaves no zombie/cache entry.
-        this._discard(id);
-        const error = errMsg(err);
-        logger.log({ type: 'mcp', event: 'connect_failed', upstream: id, error });
-        failed.push({ id, error });
-      }
-    }
-
-    return { connected, failed };
-  }
-
-  /**
-   * Discover one upstream's tool surface. Connects the upstream if it isn't already
-   * (lazily, honouring the isolation guard), runs tools/list, caches and returns the
-   * raw tool definitions [{name, description, inputSchema}]. This is what the MCP
-   * Manager 'discover' button calls.
-   *
-   * Unlike connectAll this MAY reject (it is a direct user action, so the UI wants the
-   * error) - but it cleans up a failed connection so no zombie child is left.
-   *
-   * @param {string} upstreamId
-   * @returns {Promise<Array<{name:string, description?:string, inputSchema?:object}>>}
-   */
-  async discover(upstreamId) {
-    if (!isNonEmptyString(upstreamId)) {
-      throw new Error('Aggregator.discover: upstreamId (non-empty string) is required');
-    }
-
-    // Route through ensureConnected: it JOINS an in-flight connect via _connecting instead of
-    // racing it - two concurrent discover() calls used to double-spawn the child and leak the
-    // loser without closing it. ensureConnected also reaps its own failed connects.
-    // allowDisabled: discover is the ONE caller permitted to connect a disabled upstream -
-    // inspecting its tools pre-enable worked before the race fix and stays supported.
-    try {
-      await this.ensureConnected(upstreamId, { allowDisabled: true });
-    } catch (err) {
-      throw new Error(`Aggregator.discover: cannot connect "${upstreamId}": ${errMsg(err)}`);
-    }
-    // Re-list even when the fast path returned a cached client - the discover button must always
-    // reflect live state (a fresh connect lists twice; cheap, and the semantics stay honest).
-    return await this._listAndCache(upstreamId);
-  }
-
-  /**
-   * @returns {Object<string, Array>} a clone map of upstreamId -> cached discovered tools.
-   * Only includes upstreams that have been connected/discovered this session.
-   */
-  toolsByUpstream() {
-    const out = {};
-    for (const [id, tools] of this._tools) {
-      out[id] = cloneTools(tools);
-    }
-    return out;
-  }
-
-  /**
-   * The CURATED-DIRECT tool definitions to advertise downstream. For each ENABLED
-   * expose[] entry whose upstream is CONNECTED, ENABLED and ACTUALLY advertises the named tool:
-   *   - name        = store.exposedName(entry)  (the downstream `as` name)
-   *   - description = '[' + upstream + '] ' + (upstream tool description || 'tool')
-   *   - inputSchema = the upstream tool's inputSchema || { type:'object' }
-   *
-   * Entries whose upstream isn't connected, is explicitly disabled (the row's own flag
-   * cannot override the upstream's - a discover-cached client doesn't re-admit it), or
-   * whose named tool the upstream doesn't advertise, are silently skipped.
-   *
-   * @returns {Array<{name:string, description:string, inputSchema:object}>}
-   */
-  exposedToolDefinitions() {
-    const defs = [];
-    let exposed;
-    try {
-      exposed = this._store.listExposed({ enabledOnly: true });
-    } catch (_err) {
-      return defs; // never throw out of a definition build
-    }
-
-    for (const e of exposed) {
-      if (!e || !this._clients.has(e.upstream)) continue; // upstream not connected
-      const upstream = this._store.getUpstream(e.upstream);
-      if (upstream && upstream.enabled === false) continue; // skip an explicitly-disabled upstream
-      const upstreamTools = this._tools.get(e.upstream) || [];
-      const upstreamTool = upstreamTools.find((t) => t && t.name === e.tool);
-      if (!upstreamTool) continue; // upstream doesn't actually advertise this tool
-
-      const name = this._store.exposedName(e);
-      const desc =
-        isNonEmptyString(upstreamTool.description) ? upstreamTool.description : 'tool';
-      const inputSchema =
-        upstreamTool.inputSchema && typeof upstreamTool.inputSchema === 'object'
-          ? upstreamTool.inputSchema
-          : { type: 'object' };
-
-      defs.push(withForwardedToolMeta({
-        name,
-        description: `[${e.upstream}] ${desc}`,
-        inputSchema: sanitiseXMcpHeaders(cloneJson(inputSchema)),
-      }, upstreamTool));
-    }
-    return defs;
-  }
-
-  /**
-   * The upstream ids in STORE order (expose.json's own sequence) - the stable advertisement
-   * order handleToolsList's hot-upstream block iterates by. Connection-map order
-   * shifts on death/recovery re-insertion; the store's order never does. NEVER throws.
-   * @returns {string[]}
-   */
-  upstreamOrder() {
-    try {
-      return this._store.listUpstreams().map((u) => u && u.id).filter(Boolean);
-    } catch (_e) {
-      return [];
-    }
-  }
-
-  /**
-   * Is `name` a downstream `as` name currently exposed (enabled) AND backed by a
-   * connected upstream that advertises the underlying tool? Mirrors the set
-   * exposedToolDefinitions() advertises.
-   * @param {string} name
-   * @returns {boolean}
-   */
-  isExposed(name) {
-    return this._findExposedExecution(name) !== null;
-  }
-
-  /**
-   * Resolve a downstream `as` name + args into an executor. Returns
-   *   { execute, toolName, upstream }  | null
-   * where:
-   *   - execute()  invokes the connected client's callTool(<real upstream tool name>, args)
-   *   - toolName   = the downstream `as` (what PreToolUse matchers see - the gate matches
-   *                  the downstream name, execution hits the real upstream tool)
-   *   - upstream   = the upstream id
-   * Returns null if `name` is not exposed/enabled or its upstream isn't connected.
-   *
-   * @param {string} name  downstream `as` name
-   * @param {any}    args   structured arguments forwarded verbatim to callTool
-   * @returns {{ execute: Function, toolName: string, upstream: string } | null}
-   */
-  resolveExposedExecution(name, args, meta) {
-    const hit = this._findExposedExecution(name);
-    if (!hit) return null;
-    const { client, realTool, upstream, exposedName } = hit;
-    return {
-      // The execute thunk is the seam the server calls AFTER the PreToolUse gate allows it.
-      execute: this._forwardExecutor(client, realTool, args, meta),
-      toolName: exposedName, // downstream name - the gate's matcher target
-      upstream,
-    };
-  }
-
-  // ── lean register forwarding ──────────────────────────────────────
-  // The LEAN path surfaces an attached upstream's tools through the 4 meta-tools (toolfunnel_list_tools
-  // / _tool_instructions / _run_tool) instead of injecting them top-level every turn. The full
-  // discovered set of every CONNECTED + enabled upstream is surfaced (attaching an MCP makes its
-  // tools appear with no per-tool curation); expose[]/hot governs only the SEPARATE top-level
-  // (curated-direct) promotion. A lean tool is surfaced under its enabled expose `as` if one exists,
-  // else the namespaced default `<upstream>_<tool>` - so the lean name equals the curated-direct name
-  // for an exposed tool and ONE PreToolUse rule gates both routes. All of this lives here in the
-  // aggregator (it owns the connections, the _clients/_tools caches, and the connect log chokepoint).
-
-  /**
-   * The single forward seam: a thunk that calls the upstream's real tool. Shared by the
-   * curated-direct path (resolveExposedExecution, transparent envelope passthrough) and the lean
-   * path (resolveLeanExecution, which unwraps). Kept tiny so both routes execute identically.
-   * @param {object} client   a connected McpClient
-   * @param {string} realTool the upstream's own tool name
-   * @param {any}    args
-   * @returns {() => Promise<any>}
-   */
-  _forwardExecutor(client, realTool, args, meta) {
-    return () => {
-      this._warnIfPinned(client.id, realTool);
-      return client.callTool(realTool, args, meta);
-    };
-  }
-
-  /**
-   * Legacy shim PER-CALL warning (the pin's contract: warn on every forwarded call, naming the
-   * upstream + version). Called from BOTH forward paths - curated-direct (_forwardExecutor) and
-   * lean (resolveLeanExecution's own closure; it cannot use _forwardExecutor because it needs
-   * ensureConnected + envelope unwrapping). Checked at CALL time so a live expose.json edit takes
-   * effect immediately; stderr + activity log, never the content. NEVER throws.
-   * @param {string} upstreamId
-   * @param {string} realTool  the upstream's own tool name
-   */
-  _warnIfPinned(upstreamId, realTool) {
-    try {
-      const upstream = this._store.getUpstream(upstreamId);
-      if (upstream && upstream.legacyPin === true) {
-        process.stderr.write(
-          `[toolfunnel] legacy shim: forwarding "${realTool}" to pinned legacy upstream ` +
-            `"${upstreamId}" (MCP ${LEGACY_UPSTREAM_VERSION})\n`
-        );
-        logger.log({ type: 'mcp', event: 'legacy_shim_call', upstream: upstreamId, tool: realTool, protocolVersion: LEGACY_UPSTREAM_VERSION });
-      }
-    } catch (_e) { /* the warning must never affect the call */ }
-  }
-
-  /**
-   * Legacy-shim info for a surfaced OR original call name: { upstream, protocolVersion } when the
-   * tool belongs to a PINNED (legacyPin) upstream, else null. Used by the modern era to tag
-   * results with _meta["io.toolfunnel/legacyShim"] - metadata, never content. NEVER throws.
-   * @param {string} name  the name a client called (surfaced `<upstream>_<tool>`/`as`, or the
-   *                       ORIGINAL tool name under passthrough)
-   * @returns {{ upstream: string, protocolVersion: string } | null}
-   */
-  legacyShimInfo(name) {
-    if (typeof name !== 'string' || name.length === 0) return null;
-    try {
-      const d = this.leanToolDefinitions().find((x) => x && (x.name === name || x.tool === name));
-      if (!d) return null;
-      const upstream = this._store.getUpstream(d.upstream);
-      if (!upstream || upstream.legacyPin !== true) return null;
-      return { upstream: d.upstream, protocolVersion: LEGACY_UPSTREAM_VERSION };
-    } catch (_e) {
-      return null;
-    }
-  }
-
-  /**
-   * The wrapped upstream's OWN identity, extracted from its captured `initialize` result - so a
-   * passthrough WRAP can present the wrapped server verbatim (indistinguishable from connecting to
-   * it directly, save for the ToolFunnel process). Returns { protocolVersion, serverInfo,
-   * capabilities, instructions } with best-effort extraction (some servers nest capabilities /
-   * instructions inside serverInfo), or null if the upstream isn't connected. NEVER throws.
-   * @param {string} upstreamId
-   * @returns {{ protocolVersion?:string, serverInfo?:object, capabilities?:object, instructions?:string } | null}
-   */
-  wrappedIdentity(upstreamId) {
-    try {
-      const client = this._clients.get(upstreamId);
-      if (!client || typeof client.initializeResult === 'undefined') return null;
-      const init = client.initializeResult;
-      if (!init || typeof init !== 'object') return null;
-      const si = init.serverInfo && typeof init.serverInfo === 'object' ? init.serverInfo : {};
-      // serverInfo passes VERBATIM minus the two fields some servers wrongly nest inside it
-      // (capabilities/instructions - extracted separately below). A whitelist here ate the spec's
-      // own serverInfo.title (2025-06-18) through the wrap - proven against the real
-      // server-everything (found wire-testing the wrap, 2026-07-17). Blocklist, so future identity fields survive.
-      const serverInfo = {};
-      for (const k of Object.keys(si)) {
-        if (k === 'capabilities' || k === 'instructions') continue;
-        serverInfo[k] = cloneJson(si[k]);
-      }
-      return {
-        protocolVersion: typeof init.protocolVersion === 'string' ? init.protocolVersion : undefined,
-        serverInfo: Object.keys(serverInfo).length ? serverInfo : undefined,
-        // capabilities / instructions: prefer top-level (standard), fall back to serverInfo-nested.
-        capabilities: (init.capabilities && typeof init.capabilities === 'object') ? init.capabilities
-          : (si.capabilities && typeof si.capabilities === 'object') ? si.capabilities : undefined,
-        instructions: typeof init.instructions === 'string' ? init.instructions
-          : typeof si.instructions === 'string' ? si.instructions : undefined,
-      };
-    } catch (_e) {
-      return null;
-    }
-  }
-
-  /**
-   * Forward a RAW JSON-RPC method to a connected upstream and return its result - the passthrough
-   * WRAP's relay for non-tool methods (resources/*, prompts/*, logging/*, ping...) so a wrapped
-   * server behaves exactly as it would connected directly. Uses a LIVE client only (no synchronous
-   * (re)connect - same rule as the lean run path). Throws if the upstream is not connected or the
-   * call fails; the caller shapes that into a JSON-RPC error.
-   * @param {string} upstreamId
-   * @param {string} method
-   * @param {any} params
-   * @returns {Promise<any>}
-   */
-  async forwardRaw(upstreamId, method, params, out) {
-    const client = await this.ensureConnected(upstreamId, { allowConnect: false });
-    if (!client || typeof client.request !== 'function') {
-      throw new Error(`upstream "${upstreamId}" is not connected`);
-    }
-    return await client.request(method, params, out);
-  }
-
-  /** The clientInfo to PRESENT to `upstreamId`, or null for the built-in. Fresh provider read per
-   *  call (per-connect, same as the wrap-target check); NEVER throws. */
-  _readClientInfo(upstreamId) {
-    try {
-      const info = this._clientInfoProvider ? this._clientInfoProvider(upstreamId) : null;
-      return info && typeof info === 'object' &&
-        typeof info.name === 'string' && info.name.length ? info : null;
-    } catch (_e) {
-      return null; // a broken provider degrades to the built-in identity
-    }
-  }
-
-  /** Is `upstreamId` the currently-wrapped upstream? Fresh provider read per call; NEVER throws.
-   *  Drives the per-connect isolation exemption (transparent-wrapper mode). */
-  _isWrapTarget(upstreamId) {
-    try {
-      return !!(this._wrapTargetProvider && isNonEmptyString(upstreamId) &&
-        this._wrapTargetProvider() === upstreamId);
-    } catch (_e) {
-      return false; // a broken provider must degrade to the SAFE default (guard applies)
-    }
-  }
-
-  /** Set the wrap-chatter scope. When the passthrough TARGET CHANGES (A->B, A->null, null->A) the
-   *  recorded resource subscriptions belong to the OLD context and must not replay onto the new
-   * one - a client of wrap B never subscribed to wrap A's URIs. A
-   *  same-value re-arm (every message does one) clears nothing. */
-  setWrapChatterUpstream(v) {
-    const next = v == null ? null : v;
-    if (next !== this.wrapChatterUpstream && this._subscribedUris instanceof Set) {
-      this._subscribedUris.clear();
-      if (this._subscribedRefs instanceof Map) this._subscribedRefs.clear(); // 5.4: refs go with the context
-    }
-    this.wrapChatterUpstream = next;
-  }
-
-  /** Relay a client NOTIFICATION to an upstream (wrap passthrough: notifications/cancelled,
-   *  notifications/progress ...). Fire-and-forget; never throws, never answers. */
-  notifyRaw(upstreamId, method, params) {
-    try {
-      const client = this._clients.get(upstreamId);
-      if (client && typeof client.notify === 'function') client.notify(method, params);
-    } catch (_e) { /* fire-and-forget */ }
-  }
-
-  /** TRUE if a connected upstream can ACTUALLY deliver per-URI resource updates. That means a
-   *  LEGACY upstream advertising resources.subscribe (we forward the subscribes; it emits
-   *  resources/updated). A MODERN upstream does NOT count: its only notification channel is a
-   *  subscriptions/listen stream this client does not yet open (28-July item), so counting it
-   * agreed a channel nothing would ever feed. Under a wrap only the WRAPPED
-   *  upstream counts - delivery is filtered to it, so another upstream honouring the channel
-   * would be agreed-then-dropped. The ack must never promise a dead channel. */
-  canHonourResourceSubscriptions() {
-    for (const [id, client] of this._clients) {
-      if (!client) continue;
-      if (this.wrapChatterUpstream && id !== this.wrapChatterUpstream) continue;
-      if (client.era === 'modern') continue;
-      const caps = client.initializeResult && client.initializeResult.capabilities;
-      if (caps && caps.resources && caps.resources.subscribe) return true;
-    }
-    return false;
-  }
-
-  /** Best-effort: forward resources/subscribe for each URI to every subscribe-capable legacy
-   *  upstream in scope (the wrapped one only, under a wrap). The URIs are RECORDED
-   *  so every later (re)connect replays them: a reconnected upstream is a fresh process that
-   *  remembers no subscriptions, and without the replay the client's agreed channel went silently
-   * dead forever. Fire-and-forget; never throws. */
-  subscribeResources(uris) {
-    try {
-      const list = Array.isArray(uris) ? uris.filter((u) => typeof u === 'string' && u.length) : [];
-      if (!list.length) return;
-      // 5.4: refcount per LISTEN-owned uri; the upstream subscribe is sent on the 0->1 crossing
-      // only (a re-listen agreeing the same uri must not spam idempotent subscribes).
-      const fresh = [];
-      for (const uri of list) {
-        const n = this._subscribedRefs.get(uri) || 0;
-        this._subscribedRefs.set(uri, n + 1);
-        if (!this._subscribedUris.has(uri)) { this._subscribedUris.add(uri); fresh.push(uri); }
-      }
-      if (!fresh.length) return;
-      for (const [id, client] of this._clients) {
-        if (this.wrapChatterUpstream && id !== this.wrapChatterUpstream) continue;
-        if (!client || client.era !== 'legacy' || typeof client.request !== 'function') continue;
-        const caps = client.initializeResult && client.initializeResult.capabilities;
-        if (!(caps && caps.resources && caps.resources.subscribe)) continue;
-        for (const uri of fresh) client.request('resources/subscribe', { uri }).catch(() => {});
-      }
-    } catch (_e) { /* never throw */ }
-  }
-
-  /**
-   * Release LISTEN-owned resource subscriptions (the refcount leak's fix). Decrements each
-   * uri's refcount; on the 1->0 crossing the uri leaves the replay set and the upstream is told
-   * resources/unsubscribe (same scope rules as subscribeResources). ACCEPTED EDGE, documented:
-   * a uri subscribed BOTH by a listen agreement and a client's own wrap-forwarded
-   * resources/subscribe shares one upstream channel - when the last listen releases, the
-   * upstream unsubscribe fires and the recorded Set entry goes with it (the exotic overlap is
-   * not disambiguated). NEVER throws.
-   * @param {string[]} uris
-   */
-  releaseResources(uris) {
-    try {
-      const list = Array.isArray(uris) ? uris.filter((u) => typeof u === 'string' && u.length) : [];
-      if (!list.length) return;
-      const gone = [];
-      for (const uri of list) {
-        const n = this._subscribedRefs.get(uri) || 0;
-        if (n <= 1) {
-          if (n === 1) this._subscribedRefs.delete(uri);
-          if (this._subscribedUris.has(uri)) { this._subscribedUris.delete(uri); gone.push(uri); }
-        } else {
-          this._subscribedRefs.set(uri, n - 1);
-        }
-      }
-      if (!gone.length) return;
-      for (const [id, client] of this._clients) {
-        if (this.wrapChatterUpstream && id !== this.wrapChatterUpstream) continue;
-        if (!client || client.era !== 'legacy' || typeof client.request !== 'function') continue;
-        const caps = client.initializeResult && client.initializeResult.capabilities;
-        if (!(caps && caps.resources && caps.resources.subscribe)) continue;
-        for (const uri of gone) client.request('resources/unsubscribe', { uri }).catch(() => {});
-      }
-    } catch (_e) { /* never throw */ }
-  }
-
-  /** Replay the recorded resource subscriptions onto ONE freshly-connected upstream.
-   *  Called from _connectOne so every connect path - startup, lazy, background reconnect, reload -
-   *  re-arms the channel. Same scope rules as subscribeResources. Never throws. */
-  _replaySubscriptions(upstreamId) {
-    try {
-      if (!this._subscribedUris || this._subscribedUris.size === 0) return;
-      if (this.wrapChatterUpstream && upstreamId !== this.wrapChatterUpstream) return;
-      const client = this._clients.get(upstreamId);
-      if (!client || client.era !== 'legacy' || typeof client.request !== 'function') return;
-      const caps = client.initializeResult && client.initializeResult.capabilities;
-      if (!(caps && caps.resources && caps.resources.subscribe)) return;
-      for (const uri of this._subscribedUris) client.request('resources/subscribe', { uri }).catch(() => {});
-    } catch (_e) { /* never throw */ }
-  }
-
-  /** The change-notification methods an upstream may push that we bridge to modern clients. Anything
-   *  else from the upstream is ignored (request-scoped notifications ride their own request stream). */
-  static get BRIDGED_NOTIFICATIONS() {
-    return new Set([
-      'notifications/tools/list_changed',
-      'notifications/prompts/list_changed',
-      'notifications/resources/list_changed',
-      'notifications/resources/updated',
-    ]);
-  }
-
-  /**
-   * Forward a server-initiated CHANGE notification from an upstream to the transport hook, which
-   * fans it to modern subscriptions/listen streams. Only the known change methods pass; the
-   * notification is handed on verbatim (the transport tags + filters per subscription). NEVER
-   * throws (an onNotification handler must never break the client's read loop).
-   * @param {string} upstreamId
-   * @param {object} notification  a JSON-RPC notification { method, params? }
-   */
-  _forwardUpstreamNotification(upstreamId, notification) {
-    try {
-      if (this._closed) return; // a swapped-out/torn-down aggregator must never fan out (F9)
-      if (!notification || typeof notification.method !== 'string') return;
-      // tasks/status rides the wrap-chatter lane too: the wrap advertises the
-      // upstream's `tasks` capability verbatim, so a task started through the wrap owes its
-      // status notifications exactly as a direct connection would deliver them (2025-11-25
-      // schema TaskStatusNotification). Wrapped upstream only - same scope as message/progress.
-      const isWrapChatter = this.wrapChatterUpstream === upstreamId &&
-        (notification.method === 'notifications/message' || notification.method === 'notifications/progress' ||
-         notification.method === 'notifications/tasks/status');
-      if (!Aggregator.BRIDGED_NOTIFICATIONS.has(notification.method) && !isWrapChatter) return;
-      // Forward a CLEAN notification only - a misbehaving upstream's stray `id: null` field would
-      // read as a response to downstream parsers (F7).
-      const clean = { jsonrpc: '2.0', method: notification.method };
-      if (notification.params !== undefined) clean.params = notification.params;
-      const emit = () => {
-        try {
-          if (typeof this.onUpstreamNotification === 'function') {
-            this.onUpstreamNotification(upstreamId, clean);
-          }
-        } catch (_e) { /* never let a bridged notification break the read loop */ }
-      };
-      if (notification.method === 'notifications/tools/list_changed') {
-        // A relayed "tools changed" must not point the client at a STALE surface - refresh the
-        // cache FIRST, then relay, so the re-fetch sees the new list (F2/B-M4). onToolsChanged
-        // fires too so ToolFunnel's own funnel-mode signal stays coherent.
-        this._listAndCache(upstreamId)
-          .then(() => { try { if (typeof this.onToolsChanged === 'function') this.onToolsChanged(); } catch (_e) { /* ignore */ } })
-          .catch(() => { /* refresh failed - still relay; the old cache is the best we have */ })
-          .then(emit);
-        return;
-      }
-      emit();
-    } catch (_e) { /* never let a bridged notification break the read loop */ }
-  }
-
-  /**
-   * The downstream name a discovered upstream tool is surfaced under: its ENABLED expose `as` if one
-   * exists for (upstream, tool), else the namespaced default `<upstream>_<tool>` (matching
-   * expose-store.exposedName). Keeps the lean list and the lean run path in agreement, and aligns an
-   * exposed tool's lean name with its curated-direct top-level name. Never throws.
-   * @param {string} upstreamId
-   * @param {string} toolName
-   * @returns {string}
-   */
-  _surfacedName(upstreamId, toolName) {
-    try {
-      const exposed = this._store.listExposed({ enabledOnly: true });
-      for (const e of exposed) {
-        if (e && e.upstream === upstreamId && e.tool === toolName) return this._store.exposedName(e);
-      }
-    } catch (_e) {
-      /* fall through to the default */
-    }
-    return `${upstreamId}_${toolName}`;
-  }
-
-  /**
-   * Connect an upstream ON DEMAND and return the ready McpClient. Idempotent + race-safe:
-   *   - fast path: a cached client that is still `connected` is returned as-is; a cached-but-DEAD
-   *     client (its child exited - McpClient flips `connected` but stays in the cache) is logged as a
-   *     disconnect, discarded, and reconnected - a reconnect re-lists the upstream's tools.
-   *   - concurrent callers JOIN the same in-flight connect promise (keyed in _connecting), which
-   *     resolves only AFTER _listAndCache - so no caller ever sees the half-built client that
-   *     _connectOne caches BEFORE the handshake completes (the double-spawn / mid-handshake race).
-   * Throws on an unknown/disabled upstream or a connect/list failure (the caller surfaces it; for the
-   * lean run path that means gatedRun returns { ok:false, error } cleanly).
-   * @param {string} upstreamId
-   * @returns {Promise<object>} the connected McpClient
-   */
-  async ensureConnected(upstreamId, opts) {
-    if (!isNonEmptyString(upstreamId)) throw new Error('Aggregator.ensureConnected: upstreamId (non-empty string) is required');
-    // allowConnect:false (the RUN path) must NEVER block on a connect - not a from-scratch connect
-    // (connect()+tools/list, ~20s, would freeze the serialized stdio chain and starve pings) AND not
-    // by JOINING an in-flight background reconnect (same latency). It returns a live client or fails
-    // clean; the background reconnect owns recovery and the run retries next turn. allowConnect
-    // defaults true (the background path connects / joins).
-    const allowConnect = !(opts && opts.allowConnect === false);
-    // allowDisabled: ONLY the discover path sets it - inspecting a disabled upstream's tools
-    // ("what does this have, before I enable it?") is a deliberate operator action that worked
-    // before discover was routed through here for the race fix. Every
-    // other caller keeps the refusal; a disabled upstream's tools stay OFF the lean surface
-    // regardless (leanToolDefinitions checks enabled itself).
-    const allowDisabled = !!(opts && opts.allowDisabled === true);
-    // A torn-down aggregator (swapped out by reloadExpose, then closeAll'd) must NEVER (re)connect:
-    // a captured execute thunk holding this instance would otherwise spawn an ORPHAN child on it.
-    if (this._closed) throw new Error('Aggregator.ensureConnected: aggregator is closed (config reloaded) - retry on the current one');
-
-    // A connect already in flight: JOIN it - BEFORE inspecting the cache. _connectOne caches the
-    // client pre-handshake, so a concurrent caller inspecting first sees `connected:false`, reads
-    // it as stale, closes it (killing the in-flight child mid-handshake) and then joins the
-    // connect it just doomed - both callers fail. The RUN path
-    // (allowConnect:false) still never joins - joining would block the stdio chain.
-    if (this._connecting.has(upstreamId)) {
-      if (!(opts && opts.allowConnect === false)) return this._connecting.get(upstreamId);
-      throw new Error(`Aggregator.ensureConnected: upstream "${upstreamId}" is not connected (reconnecting in background)`);
-    }
-
-    // Fast path: a live cached client serves BOTH modes immediately.
-    const existing = this._clients.get(upstreamId);
-    if (existing) {
-      const alive = typeof existing.connected === 'boolean' ? existing.connected : true;
-      if (alive) return existing;
-      // Dead cached client. The RUN path fails clean (never (re)connects); the background path drops
-      // it and reconnects below.
-      if (!allowConnect) {
-        throw new Error(`Aggregator.ensureConnected: upstream "${upstreamId}" disconnected (reconnecting in background)`);
-      }
-      logger.log({ type: 'mcp', event: 'disconnect', upstream: upstreamId, reason: 'stale' });
-      this._discard(upstreamId);
-    } else if (!allowConnect) {
-      // Not connected. The RUN path neither connects NOR joins an in-flight connect - joining would
-      // block the stdio chain for the connect+list latency (the head-of-line freeze this mode avoids).
-      throw new Error(`Aggregator.ensureConnected: upstream "${upstreamId}" is not connected (reconnecting in background)`);
-    }
-
-    // Background path only (allowConnect): connect from scratch. In-flight connects were joined
-    // at the top of the method (before cache inspection - the mid-connect discard race); nothing
-    // between there and here awaits, so no new entry can have appeared.
-    const upstream = this._store.getUpstream(upstreamId);
-    if (!upstream) throw new Error(`Aggregator.ensureConnected: unknown upstream "${upstreamId}"`);
-    if (upstream.enabled !== true && !allowDisabled) throw new Error(`Aggregator.ensureConnected: upstream "${upstreamId}" is disabled`);
-
-    const promise = (async () => {
-      await this._connectOne(upstream); // caches client + tools, logs the connect
-      return this._clients.get(upstreamId);
-    })();
-    this._connecting.set(upstreamId, promise);
-    try {
-      return await promise;
-    } catch (err) {
-      this._discard(upstreamId); // reap the half-spawned child; leave no zombie/cache entry
-      throw err;
-    } finally {
-      this._connecting.delete(upstreamId);
-    }
-  }
-
-  /**
-   * Force a fresh connect of `upstreamId` presenting the CURRENT provider-supplied identity -
-   * the wrap identity-mirror's inline path. Settles any in-flight connect FIRST: discarding a
-   * half-built client and then joining its doomed promise leaves the upstream wedged with no
-   * background reconnect and no self-heal. Rejects
-   * like ensureConnected on failure.
-   */
-  async reconnect(upstreamId) {
-    if (!isNonEmptyString(upstreamId)) throw new Error('Aggregator.reconnect: upstreamId (non-empty string) is required');
-    while (this._connecting.has(upstreamId)) {
-      try { await this._connecting.get(upstreamId); } catch (_e) { /* settled is all we need */ }
-    }
-    this._discard(upstreamId);
-    // A MANUAL kick deliberately re-runs the full era negotiation - the operator may have just
-    // upgraded the server, and "reconnect" should observe reality, not replay a memo of it.
-    this._eraMemo.delete(upstreamId);
-    try {
-      return await this.ensureConnected(upstreamId);
-    } catch (err) {
-      // This path DESTROYED a (possibly healthy) connection, and the deliberate close means
-      // onClose never fires - without this, one transient connect failure leaves no client, no
-      // in-flight connect AND no retry timer: the upstream is wedged until an external kick
-      // while ensureConnected's "reconnecting in background" message lies. The destroyer owns the retry. A stale PENDING timer (a prior death's slow
-      // 30s keepalive) must be cleared first - _scheduleReconnect's one-timer guard would
-      // otherwise no-op and leave the upstream on the long window instead of the immediate
-      // retry this path promises.
-      const stale = this._reconnectTimers.get(upstreamId);
-      if (stale) { clearTimeout(stale); this._reconnectTimers.delete(upstreamId); }
-      this._scheduleReconnect(upstreamId, 0);
-      throw err;
-    }
-  }
-
-  /**
-   * UNEXPECTED upstream death (fired by McpClient.onClose). Log it, drop the dead client so it
-   * leaves the lean list, tell the client the tool set shrank, then schedule a BACKGROUND reconnect.
-   * Keeping recovery off the serialized stdio chain is what closes the head-of-line regression: a run
-   * during the down-window fails clean (ensureConnected allowConnect:false) instead of blocking.
-   * @param {string} upstreamId
-   */
-  _handleUpstreamDown(upstreamId) {
-    if (this._closed) return;
-    logger.log({ type: 'mcp', event: 'disconnect', upstream: upstreamId, reason: 'died' });
-    this._discard(upstreamId); // remove the dead client + its tools -> drops from the lean list
-    this._signalToolsChanged(upstreamId); // list_changed only if the upstream is on the top-level surface
-    // If a reconnect ATTEMPT is already executing, it owns the next backoff step (its catch escalates
-    // attempt+1). Seeding attempt-0 here would reset the delay to 1s on every mid-attempt death, and
-    // the one-timer guard would then swallow the attempt's escalation - a permanent 1s respawn loop.
-    // Only start a fresh cycle when no attempt is in flight (the ordinary first death of a live upstream).
-    if (this._reconnecting.has(upstreamId)) return;
-    this._scheduleReconnect(upstreamId, 0);
-  }
-
-  /**
-   * Does this upstream contribute to the TOP-LEVEL tools/list (i.e. has an ENABLED expose[] entry)?
-   * Only then does its death/recovery change tools/list and warrant a notifications/tools/list_changed.
-   * A lean-only upstream's tools live behind toolfunnel_list_tools (pulled per call), so notifying for
-   * one is spurious (the client re-fetches and sees no diff). Never throws.
-   * @param {string} upstreamId
-   * @returns {boolean}
-   */
-  _affectsTopLevel(upstreamId) {
-    try {
-      // Under a WRAP the wrapped upstream IS the entire top-level surface - its death/recovery
-      // changes tools/list even with an empty expose[] (a typical wrap has no expose
-      // entries, so death/recovery was silent and clients held a stale surface forever).
-      // wrapChatterUpstream mirrors the live wrap state (armed at boot, per message, on reload).
-      if (this.wrapChatterUpstream && this.wrapChatterUpstream === upstreamId) return true;
-      // Hot-promoted upstream tools sit on the funnel's top-level surface without an expose[]
-      // entry; the host injects this predicate (armWrapChatter) because promotion lives in the
-      // tool-state overlay the aggregator has no business reading directly.
-      if (typeof this.topLevelUpstreamExtra === 'function' && this.topLevelUpstreamExtra(upstreamId)) return true;
-      return this._store.listExposed({ enabledOnly: true }).some((e) => e && e.upstream === upstreamId);
-    } catch (_e) {
-      return false;
-    }
-  }
-
-  /** Fire onToolsChanged ONLY when the upstream is actually on the top-level surface (else the
-   *  notification is spurious - its lean tools refresh on the next toolfunnel_list_tools). Never throws. */
-  _signalToolsChanged(upstreamId) {
-    if (!this._affectsTopLevel(upstreamId)) return;
-    try { this.onToolsChanged(); } catch (_e) { /* never throw out of an event handler */ }
-  }
-
-  /**
-   * Schedule ONE background reconnect attempt with exponential backoff: 1s,2s,4s,8s,16s, then capped
-   * at 30s. After the fast phase it does NOT give up - it falls back to a slow 30s keepalive so a long
-   * transient outage still self-heals (a detached/disabled upstream stops it via getUpstream; closeAll
-   * stops it via _closed). On success the tools are re-listed and a top-level change is signalled. One
-   * timer per upstream (no pile-up); the timer is unref'd so it never keeps the process alive. NEVER throws.
-   * @param {string} upstreamId
-   * @param {number} attempt
-   */
-  _scheduleReconnect(upstreamId, attempt) {
-    if (this._closed) return;
-    if (this._reconnectTimers.has(upstreamId)) return; // a reconnect is already pending for this id
-    const upstream = this._store.getUpstream(upstreamId);
-    if (!upstream || upstream.enabled !== true) return; // detached/disabled - stop trying
-    const MAX_FAST_ATTEMPTS = 6; // exponential phase; beyond it, a slow keepalive at the 30s cap
-    const delay = Math.min(1000 * Math.pow(2, attempt), 30000);
-    const timer = setTimeout(async () => {
-      this._reconnectTimers.delete(upstreamId);
-      if (this._closed) return;
-      const u = this._store.getUpstream(upstreamId);
-      if (!u || u.enabled !== true) return;
-      // Mark the attempt in flight so a death DURING ensureConnected's connect/list (onClose ->
-      // _handleUpstreamDown) does not re-seed attempt-0: THIS attempt's catch owns the escalation.
-      this._reconnecting.add(upstreamId);
-      try {
-        await this.ensureConnected(upstreamId); // allowConnect default - connects + re-lists, off-chain
-        logger.log({ type: 'mcp', event: 'reconnect', upstream: upstreamId, attempt });
-        this._signalToolsChanged(upstreamId);
-      } catch (err) {
-        logger.log({ type: 'mcp', event: 'reconnect_failed', upstream: upstreamId, attempt, error: errMsg(err) });
-        // Log the fast->slow transition exactly ONCE - when the counter FIRST reaches the cap. The
-        // old guard sat on the re-entry side, where the capped counter re-satisfied it every 30s
-        // forever against a permanently-dead upstream (log spam, not information).
-        if (attempt + 1 === MAX_FAST_ATTEMPTS) {
-          logger.log({ type: 'mcp', event: 'reconnect_slow', upstream: upstreamId, attempts: MAX_FAST_ATTEMPTS });
-        }
-        // Keep escalating to the cap, then keep retrying slowly (cap the counter so the delay stays
-        // at 30s) - never permanently give up while the upstream stays enabled. The escalation is
-        // scheduled while still in flight (the guard below checks _reconnectTimers, which is empty
-        // because a mid-attempt death was skipped) - the finally then releases the marker.
-        this._scheduleReconnect(upstreamId, Math.min(attempt + 1, MAX_FAST_ATTEMPTS));
-      } finally {
-        this._reconnecting.delete(upstreamId);
-      }
-    }, delay);
-    if (timer && typeof timer.unref === 'function') timer.unref();
-    this._reconnectTimers.set(upstreamId, timer);
-  }
-
-  /**
-   * The LEAN tool definitions: every discovered tool of every CONNECTED + enabled upstream, surfaced
-   * for toolfunnel_list_tools. Each: { name, description, inputSchema, upstream, tool }. The FULL
-   * discovered set (not just expose[]) - attaching an MCP makes its tools appear leanly with no
-   * curation. Only connected upstreams contribute (we need their real schemas); a not-yet-connected
-   * upstream's tools simply appear once it connects (the next list call reflects it - no
-   * notification needed, the lean surface is delivered inside a per-call meta-tool). Never throws.
-   * @returns {Array<{name:string, description:string, inputSchema:object, upstream:string, tool:string}>}
-   */
-  leanToolDefinitions() {
-    const defs = [];
-    const seen = new Set(); // surfaced-name collision guard - the list must agree with resolve (first wins)
-    try {
-      for (const [upstreamId, tools] of this._tools) {
-        if (!this._clients.has(upstreamId)) continue; // connected only
-        const upstream = this._store.getUpstream(upstreamId);
-        if (upstream && upstream.enabled === false) continue; // skip an explicitly-disabled upstream
-        if (!Array.isArray(tools)) continue;
-        for (const t of tools) {
-          if (!t || !isNonEmptyString(t.name)) continue;
-          const name = this._surfacedName(upstreamId, t.name);
-          if (seen.has(name)) {
-            // Two tools collapse to one surfaced name (underscore ambiguity, or a duplicate `as`).
-            // resolveLeanExecution returns the FIRST match, so advertise only the first - the list
-            // must never show a name that resolves to a different tool. Log the shadowing.
-            logger.log({ type: 'mcp', event: 'name_collision', upstream: upstreamId, tool: t.name, surfaced: name });
-            continue;
-          }
-          seen.add(name);
-          const schema = t.inputSchema && typeof t.inputSchema === 'object' ? t.inputSchema : { type: 'object' };
-          defs.push(withForwardedToolMeta({
-            name,
-            description: isNonEmptyString(t.description) ? t.description : '',
-            inputSchema: sanitiseXMcpHeaders(cloneJson(schema)),
-            upstream: upstreamId,
-            tool: t.name,
-          }, t));
-        }
-      }
-    } catch (_e) {
-      /* never throw out of a definition build - return what we have */
-    }
-    return defs;
-  }
-
-  /**
-   * Resolve a lean downstream name + args into a forwarding executor for toolfunnel_run_tool. Matches
-   * by ITERATION over discovered tools (computing each tool's surfaced name) - never by parsing the
-   * name (underscore-ambiguous). The execute thunk lazy-(re)connects via ensureConnected and UNWRAPS
-   * the upstream MCP envelope to a clean payload, so run_tool returns the upstream's content (e.g.
-   * "pong"), not a stringified envelope. The connect is INSIDE the thunk -> a PreToolUse deny spawns
-   * nothing. The gate matches `toolName` (the surfaced name). Returns null if no connected + enabled
-   * upstream advertises a tool with this surfaced name (-> protocol's clean "not runnable" error) -
-   * the same connected/enabled predicate leanToolDefinitions lists by, so hidden means not runnable.
-   * @param {string} name surfaced downstream name
-   * @param {any}    args
-   * @returns {{ execute: () => Promise<any>, toolName: string, upstream: string } | null}
-   */
-  resolveLeanExecution(name, args) {
-    if (!isNonEmptyString(name)) return null;
-    for (const [upstreamId, tools] of this._tools) {
-      if (!this._clients.has(upstreamId)) continue;
-      const upstream = this._store.getUpstream(upstreamId);
-      if (upstream && upstream.enabled === false) continue; // skip an explicitly-disabled upstream
-      if (!Array.isArray(tools)) continue;
-      for (const t of tools) {
-        if (!t || !isNonEmptyString(t.name)) continue;
-        if (this._surfacedName(upstreamId, t.name) !== name) continue;
-        const realTool = t.name;
-        const self = this;
-        const execute = async () => {
-          // allowConnect:false - the run path NEVER synchronously (re)connects (that would freeze the
-          // stdio loop, starving pings). It uses a live client or joins an in-flight background
-          // reconnect, else fails clean; the onClose-driven background reconnect owns recovery.
-          const client = await self.ensureConnected(upstreamId, { allowConnect: false });
-          self._warnIfPinned(upstreamId, realTool);
-          const envelope = await client.callTool(realTool, args);
-          // Preserve the upstream's failure signal. callTool RESOLVES even on isError:true, so a
-          // failed upstream call must become a THROW -> gatedRun returns { ok:false } -> run_tool
-          // surfaces isError:true. Otherwise a failed call would be reported as success - and the
-          // lean path must agree with curated-direct's isError passthrough.
-          const payload = unwrapEnvelope(envelope);
-          if (envelope && typeof envelope === 'object' && envelope.isError === true) {
-            const text = typeof payload === 'string' ? payload : safeStringify(payload);
-            const err = new Error(text && text.length ? text : 'upstream tool reported an error');
-            err.upstreamToolError = true;
-            throw err;
-          }
-          return payload;
-        };
-        return { execute, toolName: name, upstream: upstreamId };
-      }
-    }
-    return null;
-  }
-
-  /**
-   * resolveRawExecution - the passthrough (WRAP) twin of resolveLeanExecution. Its execute returns
-   * the upstream's tools/call result VERBATIM - multi-block content, isError, structuredContent
-   * and any future fields untouched. A wrapped client must receive exactly what a direct client
-   * would; the lean unwrap (single text block, throw-on-isError) destroys that. No unwrap, no
-   * throw-on-isError: the envelope IS the product. Uses client.request() so a modern upstream
-   * gets its per-request _meta trio.
-   * @param {string} name surfaced downstream name
-   * @param {any}    args
-   * @returns {{ execute: () => Promise<any>, toolName: string, upstream: string } | null}
-   */
-  resolveRawExecution(name, args, meta, out) {
-    if (!isNonEmptyString(name)) return null;
-    for (const [upstreamId, tools] of this._tools) {
-      if (!this._clients.has(upstreamId)) continue;
-      const upstream = this._store.getUpstream(upstreamId);
-      if (upstream && upstream.enabled === false) continue; // skip an explicitly-disabled upstream
-      if (!Array.isArray(tools)) continue;
-      for (const t of tools) {
-        if (!t || !isNonEmptyString(t.name)) continue;
-        if (this._surfacedName(upstreamId, t.name) !== name) continue;
-        const realTool = t.name;
-        const self = this;
-        const execute = async () => {
-          // allowConnect:false - same freeze-avoidance rule as the lean path.
-          const client = await self.ensureConnected(upstreamId, { allowConnect: false });
-          self._warnIfPinned(upstreamId, realTool);
-          const params = { name: realTool, arguments: args == null ? {} : args };
-          // The caller's request-scoped _meta (progressToken, trace keys - already stripped of
-          // protocol keys) rides the forward: a direct server would receive it, so the wrapped
-          // one must too - without it the upstream never emits progress for the call.
-          if (meta && typeof meta === 'object' && Object.keys(meta).length) params._meta = meta;
-          // `out.rpcId` is set synchronously at issue time - the caller's cancel-translation
-          // hook (the same contract as forwardRaw's).
-          return await client.request('tools/call', params, out);
-        };
-        return { execute, toolName: name, upstream: upstreamId };
-      }
-    }
-    return null;
-  }
-
-  /**
-   * Close every cached client and clear the caches. Idempotent - safe to call twice and
-   * safe when nothing was ever connected. NEVER throws (close() on McpClient never throws).
-   * @returns {Promise<void>}
-   */
-  async closeAll() {
-    this._closed = true; // latch BEFORE teardown so any in-flight execute thunk refuses to re-spawn
-    for (const [, timer] of this._reconnectTimers) {
-      try { clearTimeout(timer); } catch (_e) { /* ignore */ }
-    }
-    this._reconnectTimers.clear();
-    this._reconnecting.clear(); // no in-flight attempt survives teardown (its finally is a no-op then)
-    for (const [id, client] of this._clients) {
-      try {
-        if (client && typeof client.close === 'function') client.close();
-        // Activity log (self-gating): the disconnect half. A reload closes the old aggregator here,
-        // so a reconnect reads as a disconnect line followed by a connect line for the same id.
-        logger.log({ type: 'mcp', event: 'disconnect', upstream: id });
-      } catch (_e) {
-        /* McpClient.close never throws, but never let teardown sink the loop */
-      }
-    }
-    this._clients.clear();
-    this._tools.clear();
-  }
-
-  // ── internals ──────────────────────────────────────────────────────────────
-
-  /**
-   * Connect a single upstream entry and cache the client + its discovered tools.
-   * Throws on factory (isolation), connect, or listTools failure - callers decide
-   * whether to collect (connectAll) or surface (discover) the error. On throw, the
-   * caller is responsible for _discard()-ing the id.
-   * @param {object} upstream  a normalised ExposeStore upstream
-   */
-  async _connectOne(upstream) {
-    // The factory may throw (isolation guard) - that propagates out as a connect failure. Pass an
-    // onClose so an UNEXPECTED upstream death triggers a BACKGROUND reconnect (not a lazy one in the
-    // run path, which would freeze the stdio chain).
-    const client = this._clientFactory(upstream, () => this._handleUpstreamDown(upstream.id));
-    if (!client || typeof client.connect !== 'function') {
-      throw new Error(`clientFactory returned an invalid client for "${upstream.id}"`);
-    }
-    // Bridge this upstream's server-initiated change-notifications to the transport (which fans them
-    // out to modern subscriptions/listen streams). Filtered to the known change methods so arbitrary
-    // upstream chatter never reaches a client. NEVER throws.
-    client.onNotification = (n) => this._forwardUpstreamNotification(upstream.id, n);
-    // Elicitation bridge: surface server-initiated requests with the upstream id + the live client (the
-    // handler answers on it). Guarded so a handler bug can never break the client's read loop.
-    client.onServerRequest = (m) => {
-      try {
-        if (this._closed) { client.respondToServerError(m.id, -32603, 'shutting down'); return; }
-        this.onUpstreamServerRequest(upstream.id, m, client);
-      } catch (_e) {
-        try { client.respondToServerError(m.id, -32603, 'request failed'); } catch (_e2) { /* ignore */ }
-      }
-    };
-    // Cache the client BEFORE connect so a connect-failure path can still _discard() and
-    // close any half-spawned child.
-    this._clients.set(upstream.id, client);
-    try {
-      await client.connect();
-      // The LIST is part of the connect contract: a handshake that cannot list its tools is a
-      // FAILED connect to every caller, and the era observation must not outlive it either.
-      await this._listAndCache(upstream.id);
-    } catch (err) {
-      // The failed attempt may have been era-HINTED (probe skipped on the memo). Whatever the
-      // cause - handshake or the post-handshake list - a failure invalidates the observation:
-      // clear it so the NEXT attempt re-runs the full negotiation. An upstream upgraded to
-      // modern-only across a restart recovers on the following backoff retry instead of failing
-      // hinted forever.
-      this._eraMemo.delete(upstream.id);
-      throw err;
-    }
-    // Remember the negotiated era so a death-driven reconnect can skip the probe (eraHint) - but
-    // only a DEFINITIVE observation (the probe was ANSWERED). A probe that timed out proves
-    // nothing about the upstream's eras, and memoising that fallback would pin a merely-SLOW
-    // dual-era upstream to legacy on every future reconnect. A hinted connect (probe skipped)
-    // leaves the existing memo in place.
-    if (client.eraDefinitive !== false) this._eraMemo.set(upstream.id, client.era);
-    // Re-arm any agreed resource subscriptions on the fresh process - every connect
-    // path funnels through here, so reconnects and reloads replay uniformly.
-    this._replaySubscriptions(upstream.id);
-    // Activity log (self-gating; no-op unless logging is enabled): the upstream half of connect
-    // logging. EVERY connect flows through here - startup connectAll, a live reload, a lazy
-    // discover, and (later) a health-driven reconnect - so all of them are logged uniformly.
-    logger.log({
-      type: 'mcp',
-      event: 'connect',
-      upstream: upstream.id,
-      command: upstream.command,
-      tools: (this._tools.get(upstream.id) || []).length,
-    });
-    // Legacy shim STARTUP warning (the pin's contract: warn at startup AND per call, naming the
-    // version). stderr, so the operator sees it without the client's content ever growing.
-    if (upstream.legacyPin === true) {
-      try {
-        process.stderr.write(
-          `[toolfunnel] legacy shim: upstream "${upstream.id}" is PINNED to MCP ${LEGACY_UPSTREAM_VERSION} ` +
-            '(legacyPin) - this gateway keeps it working for modern clients; it cannot speak 2026-07-28 itself.\n'
-        );
-      } catch (_e) { /* never let a warning sink a connect */ }
-      logger.log({ type: 'mcp', event: 'legacy_shim_connect', upstream: upstream.id, protocolVersion: LEGACY_UPSTREAM_VERSION });
-    }
-  }
-
-  /** tools/list one connected upstream and cache the result; returns a clone. */
-  async _listAndCache(upstreamId) {
-    const client = this._clients.get(upstreamId);
-    if (!client) throw new Error(`no connected client for "${upstreamId}"`);
-    const tools = await client.listTools();
-    const safe = Array.isArray(tools) ? tools.filter((t) => t && isNonEmptyString(t.name)) : [];
-    this._tools.set(upstreamId, safe);
-    return cloneTools(safe);
-  }
-
-  /** Tear down + forget a cached client (used on a failed connect). Never throws. */
-  _discard(upstreamId) {
-    const client = this._clients.get(upstreamId);
-    if (client && typeof client.close === 'function') {
-      try { client.close(); } catch (_e) { /* never throw */ }
-    }
-    this._clients.delete(upstreamId);
-    this._tools.delete(upstreamId);
-  }
-
-  /**
-   * Shared lookup behind isExposed / resolveExposedExecution: find the ENABLED expose
-   * entry whose downstream name === `name`, whose upstream is connected AND enabled, and
-   * whose real tool the upstream advertises. Returns the resolution context or null.
-   * @param {string} name
-   * @returns {{ client:object, realTool:string, upstream:string, exposedName:string } | null}
-   */
-  _findExposedExecution(name) {
-    if (!isNonEmptyString(name)) return null;
-    let exposed;
-    try {
-      exposed = this._store.listExposed({ enabledOnly: true });
-    } catch (_err) {
-      return null;
-    }
-    for (const e of exposed) {
-      if (!e) continue;
-      if (this._store.exposedName(e) !== name) continue;
-      const client = this._clients.get(e.upstream);
-      if (!client) continue; // upstream not connected
-      const upstream = this._store.getUpstream(e.upstream);
-      if (upstream && upstream.enabled === false) continue; // skip an explicitly-disabled upstream
-      const upstreamTools = this._tools.get(e.upstream) || [];
-      if (!upstreamTools.some((t) => t && t.name === e.tool)) continue; // tool not advertised
-      return { client, realTool: e.tool, upstream: e.upstream, exposedName: name };
-    }
-    return null;
-  }
-}
-
-// ── small helpers (no external deps) ───────────────────────────────────────────
-
-/** Extract a clean message from any thrown value. */
-function errMsg(err) {
-  return (err && err.message) || String(err);
-}
-
-/** JSON.stringify that never throws (circular/oddball values fall back to String). */
-function safeStringify(value) {
-  try { return JSON.stringify(value); } catch (_e) { return String(value); }
-}
-
-/**
- * Turn an upstream MCP tools/call envelope { content:[...], isError? } into a clean payload for the
- * LEAN run path. A single text block -> its string (so toolfunnel_run_tool returns "pong", matching
- * what the curated-direct content passthrough surfaces); otherwise the content array; otherwise the
- * value as-is when it isn't an envelope. This is what avoids double-wrapping the envelope as JSON
- * inside wrapProtocolResult (the curated-direct path passes the envelope through transparently
- * instead; the lean path goes through protocol.runTool -> wrapProtocolResult, so it unwraps here).
- * NOTE: an upstream isError:true is surfaced as its text content with ok:true (homogeneous
- * with how local tools surface error text) - mapping isError -> ok:false is a later concern.
- * @param {*} envelope
- * @returns {*}
- */
-function unwrapEnvelope(envelope) {
-  if (!envelope || typeof envelope !== 'object') return envelope;
-  const content = envelope.content;
-  if (Array.isArray(content)) {
-    if (content.length === 1 && content[0] && content[0].type === 'text' && typeof content[0].text === 'string') {
-      return content[0].text;
-    }
-    return content;
-  }
-  return envelope;
-}
-
-/** Plain-JSON deep clone (schemas are JSON; structuredClone may be absent on old node). */
-function cloneJson(value) {
-  return JSON.parse(JSON.stringify(value));
-}
-
-/** The upstream tool-def metadata the funnel FORWARDS onto advertised defs.
- *  ICONS ARE WITHHELD by policy: 2025-11-25 and 2026-07-28 both require icon consumers to
- *  verify icon URIs are SAME-ORIGIN with the server, so gateway-forwarded icons are third-party
- *  URLs a conforming client must reject - or worse, trust as ours. Reversible (adding a field
- *  later is non-breaking); the decision is open - forwarding them later flips it here. */
-const FORWARDED_TOOL_META = Object.freeze(['title', 'annotations', 'outputSchema', '_meta', 'execution']);
-
-/** Selectively copy the forwardable metadata from a RAW discovered def onto an advertised def.
- *  NEVER a spread: lean defs carry internal routing ids (upstream/tool), and a spread would
- *  also inherit unknown future fields sight-unseen (the explicit selective-add rule). Mutates + returns def. */
-function withForwardedToolMeta(def, raw) {
-  if (!raw || typeof raw !== 'object') return def;
-  for (const k of FORWARDED_TOOL_META) {
-    if (raw[k] !== undefined && def[k] === undefined) def[k] = cloneJson(raw[k]);
-  }
-  return def;
-}
-
-/** HTTP field-name token syntax (RFC 9110 §5.1) - the constraint on x-mcp-header values. */
-const XMCP_TCHAR = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-
-/**
- * Strip INVALID `x-mcp-header` annotations from an advertised inputSchema, in place (0.7.0
- * ingest hygiene). The spec makes a single malformed annotation invalidate the WHOLE tool -
- * conforming Streamable-HTTP clients MUST drop it from tools/list - so forwarding a broken
- * upstream annotation verbatim makes the tool vanish client-side. Valid = on a pure
- * `properties` chain from the root, a non-empty tchar token, on a string/integer/boolean
- * param, case-insensitively unique among the valid set. Everything else is deleted (the TOOL
- * survives; the annotation was the contaminant). The WRAP path stays raw-verbatim - a wrapped
- * server's brokenness is presented faithfully, exactly as a direct connection would.
- * @param {object} schema  the advertised (already-cloned) inputSchema - mutated
- * @returns {object} schema
- */
-function sanitiseXMcpHeaders(schema) {
-  if (!schema || typeof schema !== 'object') return schema;
-  const valid = [];  // { node, name } - candidates that pass every per-node rule
-  const strip = [];  // nodes whose annotation is deleted
-  (function walk(node, onChain) {
-    if (!node || typeof node !== 'object' || Array.isArray(node)) return;
-    if (Object.prototype.hasOwnProperty.call(node, 'x-mcp-header')) {
-      const v = node['x-mcp-header'];
-      const okType = node.type === 'string' || node.type === 'integer' || node.type === 'boolean';
-      if (onChain && typeof v === 'string' && XMCP_TCHAR.test(v) && okType) valid.push({ node, name: v.toLowerCase() });
-      else strip.push(node);
-    }
-    for (const k of Object.keys(node)) {
-      const child = node[k];
-      if (!child || typeof child !== 'object') continue;
-      if (k === 'properties' && !Array.isArray(child)) {
-        for (const sub of Object.values(child)) walk(sub, onChain); // the chain continues
-      } else if (Array.isArray(child)) {
-        for (const el of child) walk(el, false); // items/oneOf/... break the chain
-      } else {
-        walk(child, false);
-      }
-    }
-  })(schema, true);
-  const seen = new Map();
-  for (const e of valid) seen.set(e.name, (seen.get(e.name) || 0) + 1);
-  for (const e of valid) if (seen.get(e.name) > 1) strip.push(e.node); // ambiguous duplicates: all go
-  for (const n of strip) delete n['x-mcp-header'];
-  return schema;
-}
-
-/** Clone an array of tool defs so callers can't mutate the aggregator's cache. */
-function cloneTools(tools) {
-  return Array.isArray(tools) ? tools.map((t) => cloneJson(t)) : [];
-}
-
-module.exports = {
-  Aggregator,
-  // exported for unit tests / reuse
-  defaultClientFactory,
-  looksLikePath,
-  isInside,
-  unwrapEnvelope,
-  DEFAULT_ROOT,
-  // 3.7: the forwardable def metadata + the selective-add - server.js's hot-promotion
-  // projection uses the same list so the two advertised paths can never drift apart again.
-  FORWARDED_TOOL_META,
-  withForwardedToolMeta,
-  // 4.3: ingest hygiene for x-mcp-header annotations (exported for tests).
-  sanitiseXMcpHeaders,
-  // A3: the wrap-time SECURITY NOTICE (bin/toolfunnel.js) enumerates the same classes the guard
-  // judges - shared lists, so the two surfaces can never classify differently.
-  isDriveRelative,
-  CODE_OPT_ENV,
-  CODE_PATH_ENV,
-};
+'use strict';
+
+/**
+ * aggregator.js - the upstream-MCP connection + curated-expose layer.
+ *
+ * The aggregator is the bridge between the persisted MCP config (src/mcp/expose-store.js)
+ * and the live upstream MCP servers (src/mcp/mcp-client.js). It:
+ *
+ *   1. CONNECTS one McpClient per ENABLED upstream in the ExposeStore (connectAll),
+ *      caching the connected client + its discovered tools. Upstreams connect CONCURRENTLY,
+ *      so startup costs the SLOWEST upstream rather than the SUM of all of them. A failed
+ *      upstream never sinks the others - failures are collected, not thrown, and each one
+ *      arms the same background reconnect a mid-session death gets.
+ *   2. DISCOVERS an upstream's tool surface on demand (discover) - what the MCP
+ *      Manager UI's 'discover' button calls.
+ *   3. Computes the CURATED-DIRECT tool definitions to advertise downstream
+ *      (exposedToolDefinitions) - only for ENABLED expose[] entries whose upstream
+ *      is connected, enabled, AND actually advertises the named tool. Each definition is
+ *      renamed to its downstream `as` name (what the CLI / PreToolUse matchers see).
+ *   4. RESOLVES a downstream call back to its upstream client + real tool name
+ *      (resolveExposedExecution) - the seam the MCP server's curated-direct call
+ *      path uses to actually execute, AFTER the hook gate has run.
+ *
+ * Decoupling note: downstream the CLI sees the renamed `as` tool; upstream we call
+ * the REAL tool name. resolveExposedExecution carries BOTH so the gate (PreToolUse)
+ * matches on the downstream name while execution hits the real upstream.
+ *
+ * SAFETY CONTRACT (mirrors expose-store.js / mcp-client.js):
+ *   - connectAll / discover / closeAll NEVER throw. connectAll collects per-upstream
+ *     failures into failed[]; a dead/misconfigured upstream cannot crash the server
+ *     start. closeAll is idempotent and tears down every cached client.
+ *   - The DEFAULT clientFactory enforces the HARD ISOLATION rule: a vendored upstream
+ *     may only reference CODE/FILES inside the gateway root. The
+ *     guard is applied to the ARGS (the script path, db files, ... that the interpreter
+ *     is pointed at): any arg that is an absolute path, or that looks like a file path
+ *     (contains a path separator), MUST resolve inside gatewayRoot - otherwise the factory
+ *     throws and connectAll records the upstream in failed[]. The COMMAND slot is the
+ *     interpreter/executable (node, npx, or an absolute path to a node binary that by
+ *     definition lives OUTSIDE the project, e.g. process.execPath / a system node.exe)
+ *     and is therefore NOT subject to the in-sandbox requirement - bare commands AND an
+ *     absolute interpreter path are both allowed. Isolation is about WHAT CODE runs in
+ *     the spawned process, not which interpreter binary runs it; the args are that code.
+ *     This is what stops a config from pointing at a live `.mcp.json` server's script
+ *     outside the sandbox while still letting the system node interpreter spawn it.
+ *
+ * CommonJS only. Node built-ins only. No new npm dependency. No @modelcontextprotocol/sdk.
+ */
+
+const path = require('node:path');
+
+const { McpClient, PROTOCOL_VERSION: LEGACY_UPSTREAM_VERSION } = require('./mcp-client');
+const logger = require('../core/logger');
+const approvals = require('./tool-approvals');
+const crypto = require('node:crypto');
+
+// The sandbox root = the CONFIG HOME (TOOLFUNNEL_HOME / --config-dir; defaults to the package
+// root - see src/core/config-home.js). Used as the isolation boundary the default clientFactory
+// enforces: a pack's path-shaped upstream args live under the home, so the home is the boundary.
+// A caller may override via opts.gatewayRoot for tests.
+const { resolveConfigHome } = require('../core/config-home');
+const DEFAULT_ROOT = resolveConfigHome();
+
+// The aggregators open in THIS process, by writer id (a config reload replaces one).
+const LIVE_WRITERS = new Set();
+
+/** Is the gateway that wrote a pending entry still running? In this process: that aggregator is
+ *  still open. Elsewhere: its process still exists. An entry with no writer is kept. */
+function writerAlive(by) {
+  if (!by || typeof by.pid !== 'number') return true;
+  if (by.pid === process.pid) return LIVE_WRITERS.has(by.id);
+  try { process.kill(by.pid, 0); return true; } catch (err) { return !!err && err.code === 'EPERM'; }
+}
+
+/** True for a non-empty string. */
+function isNonEmptyString(v) {
+  return typeof v === 'string' && v.length > 0;
+}
+
+/**
+ * Does this argv token LOOK like a file path? An absolute path (path.isAbsolute) or
+ * any token containing a path separator ('/' or '\\') is treated as a path reference
+ * and must be confined to gatewayRoot. A bare token like 'node', 'npx', 'server' or a flag
+ * like '--port' is NOT a path and is always allowed.
+ * @param {string} arg
+ * @returns {boolean}
+ */
+function looksLikePath(arg) {
+  if (!isNonEmptyString(arg)) return false;
+  if (path.isAbsolute(arg)) return true;
+  // win32 DRIVE-RELATIVE form ('C:foo.js') - path.win32.isAbsolute() is false for it and it holds
+  // no separator, so without this it looked like a bare token and skipped the guard entirely.
+  if (/^[A-Za-z]:/.test(arg)) return true;
+  return arg.indexOf('/') !== -1 || arg.indexOf('\\') !== -1;
+}
+
+/**
+ * The path-shaped candidates inside a single argv token. A runtime option in `--flag=value` form
+ * (node's --require=, --import=, --experimental-loader=, and their Deno/Bun kin) interprets only
+ * the part AFTER the first '=' as a path. The whole token '--require=../x.js' carries no '..'
+ * segment of its own, so a check of the token alone judges it inside the root while the child
+ * resolves the value and leaves it. So the value after the first '=' is returned as its own
+ * candidate, checked alongside the whole token. A non-path value ('--port=8080') simply fails
+ * looksLikePath() and is ignored; an inside value still resolves inside and passes.
+ * @param {string} arg
+ * @returns {string[]}
+ */
+function argPathCandidates(arg) {
+  if (!isNonEmptyString(arg)) return [];
+  const out = [arg];
+  const eq = arg.indexOf('=');
+  if (eq !== -1 && eq < arg.length - 1) out.push(arg.slice(eq + 1));
+  return out;
+}
+
+/**
+ * Is this a win32 DRIVE-RELATIVE reference ('C:foo', drive letter + colon + no separator)?
+ * It resolves against the CHILD's per-drive current directory - a base the guard cannot pin -
+ * so it can never be PROVEN inside the root: path.resolve(root, 'C:x') judges it optimistically
+ * when root shares the drive. There is no legitimate in-sandbox use (an inside path can always
+ * be written absolutely or plainly relative), so it is refused outright wherever paths are
+ * guarded. Checked on every platform: a config is portable and gets run somewhere else.
+ * @param {string} t
+ * @returns {boolean}
+ */
+function isDriveRelative(t) {
+  return /^[A-Za-z]:(?![\\/])/.test(t);
+}
+
+// Environment variables that make a child load code, whatever its args say. Two classes with two rules. All platforms' vars are checked on all platforms because
+// a config is portable and gets run somewhere else, and keys are compared CASE-INSENSITIVELY
+// everywhere because Windows env lookup is case-insensitive - `node_options` reaches the child
+// exactly as `NODE_OPTIONS` does, so an exact-case allowlist would be a one-character bypass there.
+//
+// OPTION-STRING vars are a mini command line in the runtime's OWN grammar: quoting, `=` forms,
+// `file:`/`data:` URLs, inspector flags. A path-shaped guard cannot verify them (quoted
+// values, URL specifiers and a bare `--inspect` all defeat any tokeniser written here),
+// and a guard that cannot verify must refuse, not guess. Refused outright in funnel mode; the
+// operator's deliberate opt-out is `allowCodeLoadingEnv: true` on the upstream entry (the
+// legacyPin pattern - off by default, visible in config, warned when it excuses something).
+const CODE_OPT_ENV = [
+  'NODE_OPTIONS',
+  'JAVA_TOOL_OPTIONS',
+  '_JAVA_OPTIONS',
+  'PERL5OPT',
+  'RUBYOPT',
+];
+// PATH / PATH-LIST vars name locations directly and ARE checkable: extract pieces, judge each
+// against the root. This list is a FLOOR, not a boundary - runtimes keep minting code-loading
+// vars, and the `command` slot is arbitrary by design (see SECURITY.md: the guard is a tripwire
+// for out-of-root references in an auditable config home, not a sandbox against an untrusted
+// pack author).
+const CODE_PATH_ENV = [
+  'NODE_PATH',
+  'NODE_REPL_EXTERNAL_MODULE',
+  'LD_PRELOAD',
+  'LD_LIBRARY_PATH',
+  'LD_AUDIT',
+  'DYLD_INSERT_LIBRARIES',
+  'DYLD_LIBRARY_PATH',
+  'DYLD_FRAMEWORK_PATH',
+  'PYTHONPATH',
+  'PYTHONSTARTUP',
+  'PYTHONHOME',
+  'PYTHONEXECUTABLE',
+  'PERL5LIB',
+  'RUBYLIB',
+  'GEM_PATH',
+  'CLASSPATH',
+  'BASH_ENV',
+  'ENV',
+  'DOTNET_STARTUP_HOOKS',
+  'CORECLR_PROFILER_PATH',
+];
+
+/**
+ * Is `target` inside `root` (or equal to it)? Compares fully-resolved, normalised
+ * absolute paths. A relative `target` is resolved AGAINST root (so 'vendor/x/server.js'
+ * checks the in-sandbox location). Returns false for anything that escapes root via
+ * '..' or an absolute path elsewhere on disk.
+ * @param {string} root    absolute sandbox root
+ * @param {string} target  path token (absolute or relative)
+ * @returns {boolean}
+ */
+function isInside(root, target) {
+  const resolvedRoot = path.resolve(root);
+  // An absolute target is checked as-is; a relative one is resolved within the root so
+  // a vendored relative path ('vendor/foo/server.js') is judged at its in-sandbox spot.
+  const resolvedTarget = path.isAbsolute(target)
+    ? path.resolve(target)
+    : path.resolve(resolvedRoot, target);
+  const rel = path.relative(resolvedRoot, resolvedTarget);
+  // Inside iff the relative path neither starts with '..' nor is itself absolute
+  // (an absolute `rel` happens on win32 across drive letters). '' (equal) counts as inside.
+  return rel === '' || (!rel.startsWith('..' + path.sep) && rel !== '..' && !path.isAbsolute(rel));
+}
+
+/**
+ * The DEFAULT clientFactory. Constructs a McpClient for an upstream entry AFTER
+ * enforcing the isolation guard on the ARGS: every arg that looks like a file path
+ * (an absolute path, or any token containing a path separator) must resolve inside
+ * `gatewayRoot`. Throws a clear 'isolation: ...' error otherwise - connectAll catches that
+ * into failed[].
+ *
+ * The COMMAND slot is intentionally NOT guarded: it names the interpreter/executable
+ * (e.g. 'node', 'npx', or an absolute path to a node binary such as process.execPath /
+ * a system node.exe) which by definition lives OUTSIDE the project. Isolation is about
+ * WHAT CODE the spawned process runs - that is the args (the server script + any data
+ * files it loads) - not which interpreter binary launches it. Guarding the command too
+ * would wrongly reject every vendored upstream the moment it is run by the system node.
+ *
+ * @param {object} upstream  a normalised ExposeStore upstream { id, command, args, env, ... }
+ * @param {string} gatewayRoot    the sandbox root the upstream's path-shaped ARGS must stay inside
+ * @returns {McpClient}
+ */
+// ── permanent connect failures ───────────────────────────────────────────────────────────────
+//
+// Every failed connect arms the background reconnect (1s,2s,4s,8s,16s, then a 30 s keepalive).
+// That is right for a slow-booting server and wrong for one that can NEVER start: a PERMANENT
+// failure runs the same ladder for PERMANENT_RETRY_LIMIT retries, then stops with one stderr line
+// and is listed by stoppedUpstreams() (and /health) until a config reload builds a fresh aggregator
+// or an operator reconnects it. Classified by the error CODE stamped where it is raised - never
+// by message text:
+//   ENOENT              the command does not exist (the client keeps the spawn error's code, and
+//                       on Windows names a command the cmd.exe launch shim hid - commandMissing)
+//   TF_ISOLATION_REFUSED the isolation guard refused the config (deterministic for a given config)
+// Not permanent: a modernOnly refusal - a slow modern server can miss the discover window and
+// look legacy once, so it keeps retrying. Store validation needs no class here: a wrong-typed
+// config is refused at load (fail-loud config) and never reaches a connect.
+const ISOLATION_REFUSED = 'TF_ISOLATION_REFUSED';
+const PERMANENT_ERROR_CODES = new Set(['ENOENT', ISOLATION_REFUSED]);
+// Retries after the failed first attempt: 1+2+4+8+16+30 s, then 8 keepalives at 30 s = 301 s, so
+// about five minutes and 15 attempts in all. Consecutive: a transient failure in between restarts
+// the count (the environment is changing), and any successful connect clears it.
+const PERMANENT_RETRY_LIMIT = 14;
+// The stop line and stoppedUpstreams()[].error keep at most this many characters of the cause.
+const STOPPED_ERROR_MAX = 400;
+
+// ── tool schema validation ──────────────────────────────────────────────────────────────────────
+//
+// One broken tool descriptor must not take its upstream down: validate each listed tool BEFORE it
+// is served and drop only that tool, loudly - degraded, not dead. It runs first at the listing
+// chokepoint, ahead of descriptor approval, so a pathological schema (nesting deep enough to exhaust
+// the stack of every recursive walk after it) is dropped as one tool instead of failing the approval
+// hash for the whole upstream. Structural checks only (zero-dep; not a JSON Schema meta-validator).
+// A MISSING (or null) field stays tolerated - a missing inputSchema is served as { type:"object" },
+// as before; real servers omit it and it is harmless. Present-but-wrong is dropped.
+const MAX_SCHEMA_DEPTH = 64;
+
+/** Does `value` nest deeper than `limit` levels? ITERATIVE on purpose: a hostile schema must not be
+ *  able to exhaust the stack of the very check meant to stop it. */
+function nestingExceeds(value, limit) {
+  const stack = [[value, 1]];
+  while (stack.length) {
+    const [v, depth] = stack.pop();
+    if (v === null || typeof v !== 'object') continue;
+    if (depth > limit) return true;
+    for (const k of Object.keys(v)) stack.push([v[k], depth + 1]);
+  }
+  return false;
+}
+
+/** @returns {string|null} the first structural defect of a listed tool, or null when it may be served. */
+function toolSchemaProblem(t) {
+  const isObj = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+  const given = (v) => v !== undefined && v !== null;
+  if (given(t.description) && typeof t.description !== 'string') return '"description" is not a string';
+  if (given(t.title) && typeof t.title !== 'string') return '"title" is not a string';
+  if (given(t.annotations) && !isObj(t.annotations)) return '"annotations" is not an object';
+  for (const f of ['inputSchema', 'outputSchema']) {
+    const s = t[f];
+    if (!given(s)) continue;
+    if (!isObj(s)) return `${f} is not a JSON Schema object`;
+    if (s.type !== undefined && s.type !== 'object') return `${f} "type" must be "object", got ${String(JSON.stringify(s.type)).slice(0, 40)}`;
+    if (s.properties !== undefined && !isObj(s.properties)) return `${f} "properties" is not an object`;
+    if (s.required !== undefined && !(Array.isArray(s.required) && s.required.every((r) => typeof r === 'string'))) {
+      return `${f} "required" is not an array of strings`;
+    }
+    if (nestingExceeds(s, MAX_SCHEMA_DEPTH)) return `${f} is nested deeper than ${MAX_SCHEMA_DEPTH} levels`;
+  }
+  return null;
+}
+
+function isPermanentConnectError(err) {
+  return !!(err && typeof err.code === 'string' && PERMANENT_ERROR_CODES.has(err.code));
+}
+
+function defaultClientFactory(upstream, gatewayRoot, onClose, allowOutsidePaths, clientInfo, eraHint) {
+  const id = isNonEmptyString(upstream && upstream.id) ? upstream.id : '(unknown)';
+  const args = Array.isArray(upstream && upstream.args) ? upstream.args : [];
+  // The caller passes TRUE for the wrapped upstream; the upstream may also claim the exemption for
+  // itself in config. Either way it is decided HERE, per upstream, from THIS upstream's own entry -
+  // there is no shared or latched state, so one server's opt-out can never relax another's guard.
+  const outsideAllowed = allowOutsidePaths === true || (upstream && upstream.allowOutsidePaths === true);
+  const byConfig = allowOutsidePaths !== true && outsideAllowed;
+
+  // Guard every field that decides WHAT CODE the spawned process runs: path-shaped args, the cwd
+  // they resolve against, and the env vars that load code irrespective of args. The command
+  // (interpreter) is NOT guarded - see the function doc: it is the executable, not the code.
+  // allowOutsidePaths: TRUE only for the currently-WRAPPED upstream (transparent-wrapper mode -
+  // the operator explicitly made this server the entire surface, e.g. server-filesystem serving
+  // a documents folder). Warn instead of refuse; funnel-mode upstreams keep the hard guard.
+  // ONE notice per CLASS, not per upstream: `warnedPath` covers the path class (args + cwd); the
+  // env section below keeps its OWN flag. A single shared flag let the first path finding consume
+  // the only slot, so an env finding - the class that loads code - was excused in total silence,
+  // precisely for the operator who opted out and most needs the audit trail.
+  let warnedPath = false;
+  const refuse = (what) => {
+    if (outsideAllowed === true) {
+      if (!warnedPath) {
+        warnedPath = true;
+        // Name the REAL reason. Reporting a config opt-out as transparent-wrapper mode would put a
+        // false explanation in the operator's log for the one event they most need to trace.
+        process.stderr.write(byConfig
+          ? `[toolfunnel] isolation: upstream "${id}" reaches outside the gateway root (${what}) - ` +
+            `permitted because its config sets allowOutsidePaths:true. This upstream is NOT isolated ` +
+            `to the config home; every tool it serves runs with that exemption. Remove the flag to ` +
+            `restore the guard, or gate the tools with a PreToolUse hook.\n`
+          : `[toolfunnel] isolation: WRAPPED upstream "${id}" reaches outside the gateway root ` +
+            `(${what}) - permitted in transparent-wrapper mode. To restrict what it can do post-wrap, see the ` +
+            `manual's "Wrapping & security" section (PreToolUse gate, per-tool enabled:false).\n`);
+      }
+      return false; // permitted under the wrap, or by this upstream's own opt-out
+    }
+    throw Object.assign(new Error(`isolation: upstream ${id} references a path outside the gateway root`), { code: ISOLATION_REFUSED });
+  };
+
+  for (const arg of args) {
+    // Check the whole token AND the value after a '=' (the --flag=value form the child splits) -
+    // either escaping the root refuses the arg. The notice still names the whole token.
+    const escapes = argPathCandidates(arg).some(
+      (cand) => looksLikePath(cand) && (isDriveRelative(cand) || !isInside(gatewayRoot, cand))
+    );
+    if (escapes) {
+      if (refuse(`arg "${arg}"`) === false) break; // one notice covers the path class
+    }
+  }
+
+  // cwd - the SPAWN BASE. Guarded because it decides where a bare, separator-free arg like
+  // 'server.js' actually resolves: looksLikePath() is false for such a token so the loop above
+  // never sees it, while the child resolves it against cwd.
+  // Drive-relative gets the same outright refusal as everywhere else: 'C:denied' resolves
+  // against the child's per-drive current directory, and isInside() judging it against the root
+  // is optimistic-and-wrong whenever the root shares the drive.
+  if (isNonEmptyString(upstream && upstream.cwd)
+    && (isDriveRelative(upstream.cwd) || !isInside(gatewayRoot, upstream.cwd))) {
+    refuse(`cwd "${upstream.cwd}"`);
+  }
+
+  // env - CODE-LOADING variables. A value in any of these loads code
+  // into the child however clean the args are (reachable in-band: tf_mcp_add forwards env
+  // verbatim). Keys are matched CASE-INSENSITIVELY on every platform - Windows env lookup is
+  // case-insensitive, so `node_options` is `NODE_OPTIONS` to the child - and every platform's
+  // variable is checked on every platform: a pack authored on Linux gets run on Windows and back.
+  //
+  // `allowCodeLoadingEnv: true` on the upstream entry is the operator's explicit opt-out for the
+  // whole class: the finding downgrades to a once-per-upstream stderr warning naming the flag.
+  const envObj = upstream && typeof upstream.env === 'object' && upstream.env ? upstream.env : null;
+  if (envObj) {
+    const envAllowed = (upstream && upstream.allowCodeLoadingEnv === true);
+    // The env class's OWN notice flag - deliberately independent of `warnedPath` (see above).
+    let warnedEnv = false;
+    const envNotice = (why) => {
+      if (warnedEnv) return;
+      warnedEnv = true;
+      process.stderr.write(`[toolfunnel] isolation: upstream "${id}" sets code-loading env ${why}`);
+    };
+    // Which flag excuses an env finding depends on its KIND:
+    //   'opt'  - option-string vars (NODE_OPTIONS et al.): not path-checkable, so ONLY the class's
+    //            own flag (allowCodeLoadingEnv) or the WRAP excuses them. allowOutsidePaths does
+    //            NOT: it is documented (expose-store) as args/cwd/path-list scope, and letting the
+    //            path flag silently disarm this separately-audited class was a cross-flag grant
+    //            the operator never made.
+    //   'path' - path-list vars (NODE_PATH et al.): inside the path flag's documented scope, so
+    //            wrap, allowCodeLoadingEnv or allowOutsidePaths excuses - each loudly, by name.
+    const refuseEnv = (what, kind) => {
+      if (envAllowed) {
+        envNotice(`(${what}) - permitted by allowCodeLoadingEnv:true on this upstream. Remove the ` +
+          'flag to restore the refusal.\n');
+        return false;
+      }
+      if (allowOutsidePaths === true) {
+        envNotice(`(${what}) - permitted in transparent-wrapper mode (this upstream IS the ` +
+          'surface). To restrict it post-wrap, see the manual\'s "Wrapping & security" section.\n');
+        return false;
+      }
+      if (kind === 'path' && outsideAllowed === true) {
+        envNotice(`(${what}) - permitted because its config sets allowOutsidePaths:true ` +
+          '(path-list env is within that flag\'s scope). Remove the flag to restore the guard.\n');
+        return false;
+      }
+      throw Object.assign(new Error(`isolation: upstream ${id} sets code-loading env (${what})`), { code: ISOLATION_REFUSED });
+    };
+    // Enumerate EXACTLY as child_process does: `for...in`, which walks own AND INHERITED keys
+    // (node's normalizeSpawnArguments: "Prototype values are intentionally included"). An
+    // Object.keys() walk was blind to a `__proto__` carrier - JSON.parse makes `__proto__` an OWN
+    // data property, spread preserves it, and the client's Object.assign merge then uses [[Set]],
+    // firing the Object.prototype.__proto__ setter and installing the payload as the merged env's
+    // PROTOTYPE: invisible to Object.keys, delivered to the child.
+    for (const key in envObj) {
+      const upper = String(key).toUpperCase();
+      // A `__proto__` key is refused OUTRIGHT, whatever it carries. It is not an env var: it is
+      // the carrier that turns into the merged env's PROTOTYPE at the client's Object.assign, and
+      // from there into real variables for the child (for..in). Nothing legitimate needs it.
+      if (key === '__proto__') {
+        refuseEnv('env "__proto__" (a prototype carrier, not an environment variable)', 'opt');
+        continue;
+      }
+      // Judge the value as the spawn will USE it, not as it was authored. node builds each pair as
+      // `${key}=${value}`, so a one-element array becomes its element verbatim and a number becomes
+      // its digits. Testing isNonEmptyString FIRST let every non-string value skip both lists -
+      // again the guard reading a different representation than the consumer. A value that cannot
+      // even be coerced is unverifiable in a code-loading slot, so it is refused rather than
+      // skipped (the same rule the option-string class already follows).
+      const rawValue = envObj[key];
+      if (rawValue === undefined || rawValue === null) continue;
+      let raw;
+      try {
+        raw = typeof rawValue === 'string' ? rawValue : String(rawValue);
+      } catch (_e) {
+        if (CODE_OPT_ENV.includes(upper) || CODE_PATH_ENV.includes(upper)) {
+          refuseEnv(`env ${key} (value cannot be read as a string, so it cannot be verified)`,
+            CODE_OPT_ENV.includes(upper) ? 'opt' : 'path');
+        }
+        continue;
+      }
+      if (raw.length === 0) continue;
+      if (CODE_OPT_ENV.includes(upper)) {
+        // Not path-checkable (see the class doc above the lists) - the VALUE is irrelevant.
+        if (refuseEnv(`env ${key} (option-string vars are not path-checkable)`, 'opt') === false) continue;
+        continue;
+      }
+      if (!CODE_PATH_ENV.includes(upper)) continue;
+      // Path / path-list value: pieces are EXTRACTED (not split) so a drive-lettered piece
+      // ('C:\x', 'C:x') survives whole on every platform - splitting 'C:relative\denied' on ':'
+      // yields fragments that resolve inside the root while the child resolves the real path
+      // outside it. Both ';' and ':' end a piece everywhere (a POSIX filename containing ';'
+      // may be shredded and falsely refused - conservative, never a false allow).
+      const parts = (raw.match(/[A-Za-z]:[^;:]*|[^;:]+/g) || []).filter((t) => t.length > 0);
+      if (parts.length === 0) continue;
+      if (parts.some((t) => isDriveRelative(t) || !isInside(gatewayRoot, t))) {
+        refuseEnv(`env ${key}="${raw}"`, 'path');
+      }
+    }
+  }
+
+  return new McpClient({
+    id: upstream.id,
+    command: upstream.command,
+    args: upstream.args,
+    env: upstream.env,
+    // Child cwd from config - the wrap era-probe reads it too; it never survived the store
+    // before. Default = the CONFIG HOME (gatewayRoot), NOT the gateway's process cwd:
+    // the isolation guard above resolves relative args against the home, so the spawn must
+    // resolve them against the SAME base or a guard-passing relative path fails to spawn
+    // whenever --config-dir differs from the launch directory (guard-base and spawn-base agree
+    // by construction).
+    cwd: isNonEmptyString(upstream && upstream.cwd) ? path.resolve(gatewayRoot, upstream.cwd) : gatewayRoot,
+    // Per-upstream `timeoutMs` config -> the client's PAYLOAD window (tools/call | prompts/get |
+    // resources/read; default 120 s).
+    toolTimeoutMs: Number.isFinite(upstream && upstream.timeoutMs) && upstream.timeoutMs > 0
+      ? upstream.timeoutMs : undefined,
+    // Per-upstream `requestTimeoutMs` config -> the CONTROL window (handshake/list/discover/
+    // ping; default 10 s = the dead-upstream detector). Opt-in for slow-boot servers that
+    // cannot answer initialize inside 10 s - without it they can never be attached at all.
+    requestTimeoutMs: Number.isFinite(upstream && upstream.requestTimeoutMs) && upstream.requestTimeoutMs > 0
+      ? upstream.requestTimeoutMs : undefined,
+    // legacyPin FORCES the legacy era: skip the modern server/discover probe and go straight to
+    // the initialize handshake, so a pinned upstream is genuinely spoken to as 2024-11-05 (the pin
+    // is an ENFORCED policy, not just a warning). Off by default.
+    forceLegacy: !!(upstream && upstream.legacyPin === true),
+    // modernOnly (legacyPin's mirror): refuse the legacy fallback - a non-modern upstream fails
+    // the connect with a clear error instead of negotiating down. Store validation refuses the
+    // legacyPin+modernOnly contradiction before it ever reaches here.
+    modernOnly: !!(upstream && upstream.modernOnly === true),
+    // The aggregator's era memo (last successful connect): 'legacy' lets a reconnect skip the
+    // server/discover probe. The client ignores it under modernOnly; the aggregator clears it on
+    // a failed connect and on an explicit reconnect().
+    eraHint: eraHint === 'legacy' ? 'legacy' : undefined,
+    // clientInfo: the identity presented to this upstream (identity mirroring / configured
+    // identity). null/undefined -> McpClient's built-in default, wire behaviour unchanged.
+    clientInfo: clientInfo || undefined,
+    onClose, // unexpected death -> the aggregator schedules a background reconnect
+  });
+}
+
+/**
+ * Aggregator - owns the live upstream connections and the curated-expose computation.
+ *
+ * Lifecycle: `new Aggregator({ store, gatewayRoot, clientFactory })`
+ *            -> `await connectAll()` (or `await discover(id)` lazily)
+ *            -> `exposedToolDefinitions()` / `resolveExposedExecution(name, args)`
+ *            -> `await closeAll()` (idempotent).
+ */
+class Aggregator {
+  /**
+   * @param {object} opts
+   * @param {object} opts.store            an ExposeStore (the on-disk MCP config).
+   * @param {string} [opts.gatewayRoot]         sandbox root for the isolation guard (default: the gateway root).
+   * @param {Function} [opts.clientFactory] (upstreamEntry, gatewayRoot) -> McpClient. Default enforces isolation.
+   * @param {Function} [opts.wrapTargetProvider] () -> the currently-WRAPPED upstream id (or null).
+   *        Read fresh at each connect: the wrapped upstream is EXEMPT from the path-isolation
+   *        guard (by design - a wrap is an explicit "this server IS my whole
+   *        surface" declaration, so ToolFunnel is a transparent wrapper in that incidence; the
+   *        operator gets a strong warning + post-wrap restriction docs instead of a refusal).
+   *        Funnel-mode upstreams keep the guard unchanged.
+   * @param {Function} [opts.clientInfoProvider] (upstreamId) -> {name, version}|null. The identity
+   *        to PRESENT to that upstream. Read fresh at each connect (same pattern as the wrap-target
+   *        provider) so a mirror captured after boot is honoured by the next (re)connect. null ->
+   *        McpClient's built-in default.
+   */
+  constructor({ store, gatewayRoot, clientFactory, onToolsChanged, wrapTargetProvider, clientInfoProvider } = {}) {
+    if (!store || typeof store !== 'object') {
+      throw new Error('Aggregator: a `store` (ExposeStore) is required');
+    }
+    this._store = store;
+    this._gatewayRoot = isNonEmptyString(gatewayRoot) ? gatewayRoot : DEFAULT_ROOT;
+    // Tool descriptor approval (tool-approvals.js). _tools holds what may be SERVED
+    // (approved descriptors only); _rawTools the upstream's own listing, so an accept re-applies
+    // without a re-list; _pending the changes that make a call refuse.
+    this._approvalsPath = path.join(this._gatewayRoot, 'mcp', 'tool-approvals.json');
+    /** @type {Map<string, Set<string>>} pending entries ("tool@hash") THIS process wrote, per upstream */
+    this._ownPending = new Map();
+    this._writer = { pid: process.pid, id: crypto.randomBytes(6).toString('hex') };
+    LIVE_WRITERS.add(this._writer.id);
+    /** @type {Map<string, object>} a record whose save FAILED, per upstream: evaluated against until a
+     *  save succeeds, so a file that cannot be written never turns each re-list into a first use */
+    this._unsaved = new Map();
+    /** @type {Set<string>} upstreams whose tools are WITHHELD (approvals unreadable or unhashable): a
+     *  call resolved earlier must refuse, not find an empty pending map and run */
+    this._withheld = new Set();
+    /** @type {Map<string, Array>} upstreamId -> the RAW tools/list result */
+    this._rawTools = new Map();
+    /** @type {Map<string, Map<string, object>>} upstreamId -> toolName -> pending entry */
+    this._pending = new Map();
+    /** @type {Array<object>} recent upgrade / server-changed events for /health (bounded) */
+    this._approvalEvents = [];
+    /** @type {Set<string>} once-per-condition stderr notices already written */
+    this._approvalNoticed = new Set();
+    /** @type {Map<string, Array<{tool:string, problem:string}>>} upstreamId -> tools dropped by schema validation */
+    this._invalid = new Map();
+    // Progress scoping: gateway token -> { upstreamId, originalToken, sink }. The
+    // random prefix means a caller's own token can never be mistaken for a gateway one.
+    this._progressRoutes = new Map();
+    this._progressPrefix = 'tfp-' + crypto.randomBytes(4).toString('hex') + '-';
+    this._progressSeq = 0;
+    // Called when the LIVE tool set changes OUT OF BAND (a background reconnect recovers or finally
+    // loses an upstream) so the transport can emit notifications/tools/list_changed. Default no-op;
+    // the server wires it to emitToolsListChanged(send). Settable so reloadExpose can re-wire the
+    // new instance.
+    this.onToolsChanged = typeof onToolsChanged === 'function' ? onToolsChanged : () => {};
+    // Called with (upstreamId, notification) for each server-initiated CHANGE notification from an
+    // upstream (resources/updated, resources/list_changed, prompts/list_changed, tools/list_changed)
+    // so the transport can bridge it to a modern client's subscriptions/listen stream. Default no-op;
+    // the server/http host wires it. Settable so reloadExpose can re-wire the new instance.
+    this.onUpstreamNotification = () => {};
+    // Called with (upstreamId, requestMsg, client) for each SERVER-INITIATED REQUEST from an
+    // upstream (elicitation/create, sampling/createMessage, roots/list - the elicitation bridge). The handler
+    // owns answering via client.respondToServer(Error). Default: -32601, so an unwired build
+    // never leaves an upstream holding an open request. Settable; reloadExpose carries it over.
+    this.onUpstreamServerRequest = (uid, msg, client) => {
+      try { client.respondToServerError(msg.id, -32601, 'Method not found: ' + msg.method); } catch (_e) { /* never throw */ }
+    };
+    // When a passthrough WRAP is active, the wrapped upstream's request-scoped chatter
+    // (notifications/message, notifications/progress) also bridges - connected directly, the
+    // client would receive it. The server keeps this current with the live wrap state.
+    this.wrapChatterUpstream = null;
+    this._wrapTargetProvider = typeof wrapTargetProvider === 'function' ? wrapTargetProvider : null;
+    this._clientInfoProvider = typeof clientInfoProvider === 'function' ? clientInfoProvider : null;
+    // The factory receives (upstream, gatewayRoot, onClose). A caller-supplied factory may ignore the
+    // extra args; the default uses gatewayRoot for isolation and onClose for death-driven reconnect.
+    // The wrap-target check runs PER CONNECT (fresh provider read), so a wrap set after boot is
+    // honoured by the next connect attempt.
+    this._clientFactory =
+      typeof clientFactory === 'function'
+        ? (upstream, onClose) => clientFactory(upstream, this._gatewayRoot, onClose)
+        : (upstream, onClose) => defaultClientFactory(upstream, this._gatewayRoot, onClose,
+            this._isWrapTarget(upstream && upstream.id),
+            this._readClientInfo(upstream && upstream.id),
+            this._eraMemo.get(upstream && upstream.id));
+
+    /** @type {Map<string, object>} upstreamId -> connected McpClient */
+    this._clients = new Map();
+    /** @type {Map<string, Array>} upstreamId -> discovered tool defs [{name,description,inputSchema}] */
+    this._tools = new Map();
+    /** @type {Map<string, Promise>} upstreamId -> in-flight connect promise (race guard for ensureConnected) */
+    this._connecting = new Map();
+    /** @type {Set<string>} agreed resource-subscription URIs - replayed onto every (re)connect
+     * of a subscribe-capable legacy upstream so the channel survives reconnects */
+    this._subscribedUris = new Set();
+    /** @type {Map<string, number>} uri -> LISTEN-owned refcount. subscribeResources
+     * increments; releaseResources decrements and unsubscribes upstream at zero. The wrap-forward
+     * recording (a client's own resources/subscribe) writes the Set directly and is NOT counted
+     * here - the client manages that lifetime itself. */
+    this._subscribedRefs = new Map();
+    /** @type {Map<string, any>} upstreamId -> pending background-reconnect timer (one per upstream) */
+    this._reconnectTimers = new Map();
+    /** @type {Set<string>} upstreams whose reconnect ATTEMPT is currently executing (between the timer
+     * firing - which deletes its own entry from _reconnectTimers - and the attempt settling). While an
+     * id is in here, _handleUpstreamDown must NOT seed a fresh attempt-0: the in-flight attempt's own
+     * catch owns the next backoff step. Without this, a death DURING an attempt's tools/list re-seeds
+     * the 1s floor and the one-timer guard then swallows the escalation - a permanent 1s respawn loop. */
+    this._reconnecting = new Set();
+    /** @type {Map<string, number>} upstreamId -> CONSECUTIVE permanent-class connect failures
+     *  (PERMANENT_ERROR_CODES). Cleared by a transient failure or any successful connect. */
+    this._permanentFailures = new Map();
+    /** @type {Map<string, {error:string, attempts:number}>} upstreams that hit
+     *  PERMANENT_RETRY_LIMIT and stopped retrying - stoppedUpstreams() / /health. */
+    this._stopped = new Map();
+    /** @type {Map<string, 'modern'|'legacy'>} upstreamId -> era negotiated at the LAST successful
+     * connect. A death-driven reconnect passes it to the client as eraHint so a legacy upstream
+     * skips the server/discover probe (worst case ~3s against a server that silently drops unknown
+     * methods) instead of re-paying it on every respawn. Lifecycle: SET on a successful connect,
+     * CLEARED when a connect fails (the hinted attempt may be why - the next retry re-negotiates
+     * in full, so an upstream upgraded across a restart self-heals) and by an explicit reconnect()
+     * (a manual kick deliberately re-negotiates). A config reload swaps in a fresh Aggregator, so
+     * a changed entry never inherits a stale memo. */
+    this._eraMemo = new Map();
+    /** Set true by closeAll(). A torn-down aggregator (e.g. swapped out by reloadExpose) must NEVER
+     *  (re)connect - a captured execute thunk holding this instance would otherwise spawn an orphan
+     *  upstream child on it that nothing ever closes. ensureConnected/connectAll check this. */
+    this._closed = false;
+  }
+
+  /**
+   * Connect every ENABLED upstream in the store, caching each connected client and its
+   * discovered tools. NEVER throws - a per-upstream failure (isolation guard, spawn
+   * failure, handshake timeout, listTools failure) is collected into failed[]. An
+   * upstream already connected (cached) is treated as connected without reconnecting.
+   *
+   * A startup failure is not a one-off failed[] entry: every failed upstream is handed to
+   * _scheduleReconnect - exponential 1s..16s, then the 30s keepalive, the same treatment a
+   * mid-session death gets; reconnect_slow is logged once when the slow phase begins, and
+   * failed[] still reports the startup outcome to the caller. A PERMANENT failure (missing
+   * command, isolation refusal) counts toward PERMANENT_RETRY_LIMIT and then stops.
+   *
+   * @returns {Promise<{ connected: string[], failed: Array<{id:string, error:string}> }>}
+   */
+  async connectAll() {
+    const connected = [];
+    const failed = [];
+    if (this._closed) return { connected, failed }; // a closed (torn-down) aggregator never connects
+
+    let upstreams;
+    try {
+      upstreams = this._store.listUpstreams();
+    } catch (err) {
+      // listUpstreams() shouldn't throw (it clones), but never let it sink connectAll.
+      return { connected, failed: [{ id: '(store)', error: errMsg(err) }] };
+    }
+
+    // CONCURRENT connect. Per-upstream cost is dominated by process boot, remote round-trips and
+    // the dual-era probe window, so connecting SEQUENTIALLY made startup the SUM of every
+    // upstream's latency; started together it is the SLOWEST one instead. Upstreams are
+    // independent: _connectOne touches only this upstream's own entry in _clients/_tools/_eraMemo,
+    // and the store rejects duplicate ids at load, so there is no cross-upstream state to race on.
+    // Each promise carries its own cleanup, and allSettled means ONE upstream's failure can never
+    // reject the batch - the NEVER-THROWS contract above still holds.
+    const tasks = [];
+    for (const upstream of upstreams) {
+      if (!upstream || upstream.enabled !== true) continue; // only ENABLED upstreams
+
+      const id = upstream.id;
+      if (this._clients.has(id)) {
+        // Already connected this session - keep it; don't double-spawn.
+        tasks.push({ id, cached: true, promise: null });
+        continue;
+      }
+
+      // Discard INSIDE the catch (not in the result loop below) so a half-built client is reaped
+      // the moment its connect fails, instead of lingering for the rest of the batch. The rethrow
+      // hands the original error to allSettled; a throwing _discard must never mask it.
+      //
+      // Registered in _connecting for the life of the task, exactly like ensureConnected's own
+      // connect: _connectOne caches the client BEFORE its handshake completes, so a concurrent
+      // ensureConnected(id) that inspected the cache instead of joining would read it as stale,
+      // discard it mid-handshake and connect a second time. Joiners get the client (same shape as
+      // ensureConnected's promise); the entry clears on settle either way.
+      const promise = (async () => {
+        await this._connectOne(upstream);
+        return this._clients.get(id);
+      })().catch((err) => {
+        try { this._discard(id); } catch (_e) { /* cleanup is best-effort; report the real error */ }
+        throw err;
+      }).finally(() => { this._connecting.delete(id); });
+      this._connecting.set(id, promise);
+      tasks.push({ id, cached: false, promise });
+    }
+
+    const settled = await Promise.allSettled(tasks.map((t) => t.promise));
+
+    // Walk the tasks in STORE order so connected[]/failed[] stay stable and every enabled
+    // upstream lands in EXACTLY ONE of them - a settled promise is fulfilled or rejected, so
+    // no upstream can fall through this loop unreported.
+    for (let i = 0; i < tasks.length; i++) {
+      const { id, cached } = tasks[i];
+      if (cached || settled[i].status === 'fulfilled') {
+        connected.push(id);
+        continue;
+      }
+      const error = errMsg(settled[i].reason);
+      logger.log({ type: 'mcp', event: 'connect_failed', upstream: id, error });
+      failed.push({ id, error });
+      if (this._countConnectFailure(id, settled[i].reason)) continue; // (a limit of 0 would stop here)
+      // A STARTUP failure is usually transient - a slow-booting upstream that missed its
+      // handshake window while eleven siblings were spawning next to it. Arm the same
+      // self-healing backoff a mid-session death gets: without it a startup failure stranded
+      // the upstream with no client, no in-flight connect and no timer for the WHOLE session,
+      // silently costing the agent that upstream's tools. The retry runs off-chain (unref'd
+      // timer) and signals tools/list_changed when the upstream comes back.
+      this._scheduleReconnect(id, 0);
+    }
+
+    return { connected, failed };
+  }
+
+  /**
+   * Discover one upstream's tool surface. Connects the upstream if it isn't already
+   * (lazily, honouring the isolation guard), runs tools/list, caches and returns the
+   * raw tool definitions [{name, description, inputSchema}]. This is what the MCP
+   * Manager 'discover' button calls.
+   *
+   * Unlike connectAll this MAY reject (it is a direct user action, so the UI wants the
+   * error) - but it cleans up a failed connection so no zombie child is left.
+   *
+   * @param {string} upstreamId
+   * @returns {Promise<Array<{name:string, description?:string, inputSchema?:object}>>}
+   */
+  async discover(upstreamId) {
+    if (!isNonEmptyString(upstreamId)) {
+      throw new Error('Aggregator.discover: upstreamId (non-empty string) is required');
+    }
+
+    // Route through ensureConnected: it JOINS an in-flight connect via _connecting instead of
+    // racing it, so two concurrent discover() calls cannot double-spawn the child and leak the
+    // loser. ensureConnected also reaps its own failed connects.
+    // allowDisabled: discover is the ONE caller permitted to connect a disabled upstream, so a
+    // disabled upstream's tools can be inspected before enabling it.
+    try {
+      await this.ensureConnected(upstreamId, { allowDisabled: true });
+    } catch (err) {
+      throw new Error(`Aggregator.discover: cannot connect "${upstreamId}": ${errMsg(err)}`);
+    }
+    // Re-list even when the fast path returned a cached client - the discover button must always
+    // reflect live state (a fresh connect lists twice; cheap, and the semantics stay honest).
+    return await this._listAndCache(upstreamId);
+  }
+
+  /**
+   * @returns {Object<string, Array>} a clone map of upstreamId -> cached discovered tools.
+   * Only includes upstreams that have been connected/discovered this session.
+   */
+  toolsByUpstream() {
+    const out = {};
+    for (const [id, tools] of this._tools) {
+      out[id] = cloneTools(tools);
+    }
+    return out;
+  }
+
+  /**
+   * The CURATED-DIRECT tool definitions to advertise downstream. For each ENABLED
+   * expose[] entry whose upstream is CONNECTED, ENABLED and ACTUALLY advertises the named tool:
+   *   - name        = store.exposedName(entry)  (the downstream `as` name)
+   *   - description = '[' + upstream + '] ' + (upstream tool description || 'tool')
+   *   - inputSchema = the upstream tool's inputSchema || { type:'object' }
+   *
+   * Entries whose upstream isn't connected, is explicitly disabled (the row's own flag
+   * cannot override the upstream's - a discover-cached client doesn't re-admit it), or
+   * whose named tool the upstream doesn't advertise, are silently skipped.
+   *
+   * @returns {Array<{name:string, description:string, inputSchema:object}>}
+   */
+  exposedToolDefinitions() {
+    const defs = [];
+    let exposed;
+    try {
+      exposed = this._store.listExposed({ enabledOnly: true });
+    } catch (_err) {
+      return defs; // never throw out of a definition build
+    }
+
+    for (const e of exposed) {
+      if (!e || !this._clients.has(e.upstream)) continue; // upstream not connected
+      const upstream = this._store.getUpstream(e.upstream);
+      if (upstream && upstream.enabled === false) continue; // skip an explicitly-disabled upstream
+      const upstreamTools = this._tools.get(e.upstream) || [];
+      const upstreamTool = upstreamTools.find((t) => t && t.name === e.tool);
+      if (!upstreamTool) continue; // upstream doesn't actually advertise this tool
+
+      const name = this._store.exposedName(e);
+      const desc =
+        isNonEmptyString(upstreamTool.description) ? upstreamTool.description : 'tool';
+      const inputSchema =
+        upstreamTool.inputSchema && typeof upstreamTool.inputSchema === 'object'
+          ? upstreamTool.inputSchema
+          : { type: 'object' };
+
+      defs.push(withForwardedToolMeta({
+        name,
+        description: `[${e.upstream}] ${desc}`,
+        inputSchema: sanitiseXMcpHeaders(cloneJson(inputSchema)),
+      }, upstreamTool));
+    }
+    return defs;
+  }
+
+  /**
+   * The upstream ids in STORE order (expose.json's own sequence) - the stable advertisement
+   * order handleToolsList's hot-upstream block iterates by. Connection-map order
+   * shifts on death/recovery re-insertion; the store's order never does. NEVER throws.
+   * @returns {string[]}
+   */
+  upstreamOrder() {
+    try {
+      return this._store.listUpstreams().map((u) => u && u.id).filter(Boolean);
+    } catch (_e) {
+      return [];
+    }
+  }
+
+  /**
+   * Is `name` a downstream `as` name currently exposed (enabled) AND backed by a
+   * connected upstream that advertises the underlying tool? Mirrors the set
+   * exposedToolDefinitions() advertises.
+   * @param {string} name
+   * @returns {boolean}
+   */
+  isExposed(name) {
+    return this._findExposedExecution(name) !== null;
+  }
+
+  /**
+   * Resolve a downstream `as` name + args into an executor. Returns
+   *   { execute, toolName, upstream }  | null
+   * where:
+   *   - execute()  invokes the connected client's callTool(<real upstream tool name>, args)
+   *   - toolName   = the downstream `as` (what PreToolUse matchers see - the gate matches
+   *                  the downstream name, execution hits the real upstream tool)
+   *   - upstream   = the upstream id
+   * Returns null if `name` is not exposed/enabled or its upstream isn't connected.
+   *
+   * @param {string} name  downstream `as` name
+   * @param {any}    args   structured arguments forwarded verbatim to callTool
+   * @returns {{ execute: Function, toolName: string, upstream: string } | null}
+   */
+  resolveExposedExecution(name, args, meta, progress) {
+    const hit = this._findExposedExecution(name);
+    if (!hit) return null;
+    const { client, realTool, upstream, exposedName } = hit;
+    return {
+      // The execute thunk is the seam the server calls AFTER the PreToolUse gate allows it.
+      execute: this._forwardExecutor(client, realTool, args, meta, upstream, progress),
+      toolName: exposedName, // downstream name - the gate's matcher target
+      upstream,
+    };
+  }
+
+  // ── lean register forwarding ──────────────────────────────────────
+  // The LEAN path surfaces an attached upstream's tools through the 4 meta-tools (toolfunnel_list_tools
+  // / _tool_instructions / _run_tool) instead of injecting them top-level every turn. The full
+  // discovered set of every CONNECTED + enabled upstream is surfaced (attaching an MCP makes its
+  // tools appear with no per-tool curation); expose[]/hot governs only the SEPARATE top-level
+  // (curated-direct) promotion. A lean tool is surfaced under its enabled expose `as` if one exists,
+  // else the namespaced default `<upstream>_<tool>` - so the lean name equals the curated-direct name
+  // for an exposed tool and ONE PreToolUse rule gates both routes. All of this lives here in the
+  // aggregator (it owns the connections, the _clients/_tools caches, and the connect log chokepoint).
+
+  /**
+   * The single forward seam: a thunk that calls the upstream's real tool. Shared by the
+   * curated-direct path (resolveExposedExecution, transparent envelope passthrough) and the lean
+   * path (resolveLeanExecution, which unwraps). Kept tiny so both routes execute identically.
+   * @param {object} client   a connected McpClient
+   * @param {string} realTool the upstream's own tool name
+   * @param {any}    args
+   * @returns {() => Promise<any>}
+   */
+  _forwardExecutor(client, realTool, args, meta, upstreamId, progress) {
+    return () => {
+      // Checked when the call RUNS, not when it resolved: the tool can change while a permission
+      // prompt waits on the user.
+      const refusal = this._approvalRefusal(upstreamId || client.id, realTool, 'curated');
+      if (refusal) return Promise.resolve(refusal.envelope);
+      this._warnIfPinned(client.id, realTool);
+      const scoped = this._scopeProgress(upstreamId || client.id, meta, progress);
+      return Promise.resolve()
+        .then(() => client.callTool(realTool, args, scoped.meta))
+        .finally(scoped.release);
+    };
+  }
+
+  /**
+   * Scope a caller's progressToken to this one call. Client tokens are client-chosen,
+   * so two callers can use the same one over a shared upstream - and the spec says a token "MUST be
+   * unique across all active requests" from its SENDER, which toward the upstream is the gateway.
+   * With a `progress` sink the token is rewritten to a gateway token and that token's beats are
+   * routed back to the sink with the caller's token restored (_forwardUpstreamNotification). Without
+   * a sink the meta goes through unchanged (the token still keeps the upstream's timeout alive).
+   * @returns {{ meta: object|undefined, release: () => void }} release() when the call settles
+   */
+  _scopeProgress(upstreamId, meta, progress) {
+    const tok = meta && typeof meta === 'object' ? meta.progressToken : undefined;
+    if (typeof progress !== 'function' || !((typeof tok === 'string' && tok.length) || Number.isInteger(tok))) {
+      return { meta, release: () => {} };
+    }
+    const gatewayToken = this._progressPrefix + (++this._progressSeq);
+    this._progressRoutes.set(gatewayToken, { upstreamId, originalToken: tok, sink: progress });
+    return {
+      meta: Object.assign({}, meta, { progressToken: gatewayToken }),
+      release: () => { this._progressRoutes.delete(gatewayToken); },
+    };
+  }
+
+  /**
+   * Legacy shim PER-CALL warning (the pin's contract: warn on every forwarded call, naming the
+   * upstream + version). Called from BOTH forward paths - curated-direct (_forwardExecutor) and
+   * lean (resolveLeanExecution's own closure; it cannot use _forwardExecutor because it needs
+   * ensureConnected + envelope unwrapping). Checked at CALL time so a live expose.json edit takes
+   * effect immediately; stderr + activity log, never the content. NEVER throws.
+   * @param {string} upstreamId
+   * @param {string} realTool  the upstream's own tool name
+   */
+  _warnIfPinned(upstreamId, realTool) {
+    try {
+      const upstream = this._store.getUpstream(upstreamId);
+      if (upstream && upstream.legacyPin === true) {
+        process.stderr.write(
+          `[toolfunnel] legacy shim: forwarding "${realTool}" to pinned legacy upstream ` +
+            `"${upstreamId}" (MCP ${LEGACY_UPSTREAM_VERSION})\n`
+        );
+        logger.log({ type: 'mcp', event: 'legacy_shim_call', upstream: upstreamId, tool: realTool, protocolVersion: LEGACY_UPSTREAM_VERSION });
+      }
+    } catch (_e) { /* the warning must never affect the call */ }
+  }
+
+  /**
+   * Legacy-shim info for a surfaced OR original call name: { upstream, protocolVersion } when the
+   * tool belongs to a PINNED (legacyPin) upstream, else null. Used by the modern era to tag
+   * results with _meta["io.toolfunnel/legacyShim"] - metadata, never content. NEVER throws.
+   * @param {string} name  the name a client called (surfaced `<upstream>_<tool>`/`as`, or the
+   *                       ORIGINAL tool name under passthrough)
+   * @returns {{ upstream: string, protocolVersion: string } | null}
+   */
+  legacyShimInfo(name) {
+    if (typeof name !== 'string' || name.length === 0) return null;
+    try {
+      const d = this.leanToolDefinitions().find((x) => x && (x.name === name || x.tool === name));
+      if (!d) return null;
+      const upstream = this._store.getUpstream(d.upstream);
+      if (!upstream || upstream.legacyPin !== true) return null;
+      return { upstream: d.upstream, protocolVersion: LEGACY_UPSTREAM_VERSION };
+    } catch (_e) {
+      return null;
+    }
+  }
+
+  /**
+   * The wrapped upstream's OWN identity, extracted from its captured `initialize` result - so a
+   * passthrough WRAP can present the wrapped server verbatim (indistinguishable from connecting to
+   * it directly, save for the ToolFunnel process). Returns { protocolVersion, serverInfo,
+   * capabilities, instructions } with best-effort extraction (some servers nest capabilities /
+   * instructions inside serverInfo), or null if the upstream isn't connected. NEVER throws.
+   * @param {string} upstreamId
+   * @returns {{ protocolVersion?:string, serverInfo?:object, capabilities?:object, instructions?:string } | null}
+   */
+  wrappedIdentity(upstreamId) {
+    try {
+      const client = this._clients.get(upstreamId);
+      if (!client || typeof client.initializeResult === 'undefined') return null;
+      const init = client.initializeResult;
+      if (!init || typeof init !== 'object') return null;
+      const si = init.serverInfo && typeof init.serverInfo === 'object' ? init.serverInfo : {};
+      // serverInfo passes VERBATIM minus the two fields some servers wrongly nest inside it
+      // (capabilities/instructions - extracted separately below). A blocklist, not a whitelist,
+      // so the spec's serverInfo.title (2025-06-18) and future identity fields survive the wrap.
+      const serverInfo = {};
+      for (const k of Object.keys(si)) {
+        if (k === 'capabilities' || k === 'instructions') continue;
+        serverInfo[k] = cloneJson(si[k]);
+      }
+      return {
+        protocolVersion: typeof init.protocolVersion === 'string' ? init.protocolVersion : undefined,
+        serverInfo: Object.keys(serverInfo).length ? serverInfo : undefined,
+        // capabilities / instructions: prefer top-level (standard), fall back to serverInfo-nested.
+        capabilities: (init.capabilities && typeof init.capabilities === 'object') ? init.capabilities
+          : (si.capabilities && typeof si.capabilities === 'object') ? si.capabilities : undefined,
+        instructions: typeof init.instructions === 'string' ? init.instructions
+          : typeof si.instructions === 'string' ? si.instructions : undefined,
+      };
+    } catch (_e) {
+      return null;
+    }
+  }
+
+  /**
+   * Forward a RAW JSON-RPC method to a connected upstream and return its result - the passthrough
+   * WRAP's relay for non-tool methods (resources/*, prompts/*, logging/*, ping...) so a wrapped
+   * server behaves exactly as it would connected directly. Uses a LIVE client only (no synchronous
+   * (re)connect - same rule as the lean run path). Throws if the upstream is not connected or the
+   * call fails; the caller shapes that into a JSON-RPC error.
+   * @param {string} upstreamId
+   * @param {string} method
+   * @param {any} params
+   * @returns {Promise<any>}
+   */
+  async forwardRaw(upstreamId, method, params, out) {
+    const client = await this.ensureConnected(upstreamId, { allowConnect: false });
+    if (!client || typeof client.request !== 'function') {
+      throw new Error(`upstream "${upstreamId}" is not connected`);
+    }
+    return await client.request(method, params, out);
+  }
+
+  /** The clientInfo to PRESENT to `upstreamId`, or null for the built-in. Fresh provider read per
+   *  call (per-connect, same as the wrap-target check); NEVER throws. */
+  _readClientInfo(upstreamId) {
+    try {
+      const info = this._clientInfoProvider ? this._clientInfoProvider(upstreamId) : null;
+      return info && typeof info === 'object' &&
+        typeof info.name === 'string' && info.name.length ? info : null;
+    } catch (_e) {
+      return null; // a broken provider degrades to the built-in identity
+    }
+  }
+
+  /** Is `upstreamId` the currently-wrapped upstream? Fresh provider read per call; NEVER throws.
+   *  Drives the per-connect isolation exemption (transparent-wrapper mode). */
+  _isWrapTarget(upstreamId) {
+    try {
+      return !!(this._wrapTargetProvider && isNonEmptyString(upstreamId) &&
+        this._wrapTargetProvider() === upstreamId);
+    } catch (_e) {
+      return false; // a broken provider must degrade to the SAFE default (guard applies)
+    }
+  }
+
+  /** Set the wrap-chatter scope. When the passthrough TARGET CHANGES (A->B, A->null, null->A) the
+   *  recorded resource subscriptions belong to the OLD context and must not replay onto the new
+   * one - a client of wrap B never subscribed to wrap A's URIs. A
+   *  same-value re-arm (every message does one) clears nothing. */
+  setWrapChatterUpstream(v) {
+    const next = v == null ? null : v;
+    if (next !== this.wrapChatterUpstream && this._subscribedUris instanceof Set) {
+      // Tell the OUTGOING target to drop them first - it was told resources/subscribe for every
+      // one and, forgotten only locally, kept emitting resources/updated for URIs nothing consumed
+      // for the life of its process. releaseResources fans out to the CURRENT wrapChatterUpstream,
+      // so it runs BEFORE the reassignment; the refs are dropped wholesale first because a context
+      // switch releases everything, whatever the listen refcounts said.
+      if (this._subscribedUris.size) {
+        const uris = [...this._subscribedUris];
+        if (this._subscribedRefs instanceof Map) this._subscribedRefs.clear();
+        this.releaseResources(uris);
+      }
+      this._subscribedUris.clear();
+      if (this._subscribedRefs instanceof Map) this._subscribedRefs.clear(); // 5.4: refs go with the context
+    }
+    this.wrapChatterUpstream = next;
+  }
+
+  /** Relay a client NOTIFICATION to an upstream (wrap passthrough: notifications/cancelled,
+   *  notifications/progress ...). Fire-and-forget; never throws, never answers. */
+  notifyRaw(upstreamId, method, params) {
+    try {
+      const client = this._clients.get(upstreamId);
+      if (client && typeof client.notify === 'function') client.notify(method, params);
+    } catch (_e) { /* fire-and-forget */ }
+  }
+
+  /** TRUE if a connected upstream can ACTUALLY deliver per-URI resource updates. That means a
+   *  LEGACY upstream advertising resources.subscribe (we forward the subscribes; it emits
+   *  resources/updated). A MODERN upstream does NOT count: its only notification channel is a
+   *  subscriptions/listen stream this client does not yet open (28-July item), so counting it
+   * agreed a channel nothing would ever feed. Under a wrap only the WRAPPED
+   *  upstream counts - delivery is filtered to it, so another upstream honouring the channel
+   * would be agreed-then-dropped. The ack must never promise a dead channel. */
+  canHonourResourceSubscriptions() {
+    for (const [id, client] of this._clients) {
+      if (!client) continue;
+      if (this.wrapChatterUpstream && id !== this.wrapChatterUpstream) continue;
+      if (client.era === 'modern') continue;
+      const caps = client.initializeResult && client.initializeResult.capabilities;
+      if (caps && caps.resources && caps.resources.subscribe) return true;
+    }
+    return false;
+  }
+
+  /** Best-effort: forward resources/subscribe for each URI to every subscribe-capable legacy
+   *  upstream in scope (the wrapped one only, under a wrap). The URIs are RECORDED
+   *  so every later (re)connect replays them: a reconnected upstream is a fresh process that
+   *  remembers no subscriptions, and without the replay the client's agreed channel went silently
+   * dead forever. Fire-and-forget; never throws. */
+  subscribeResources(uris) {
+    try {
+      const list = Array.isArray(uris) ? uris.filter((u) => typeof u === 'string' && u.length) : [];
+      if (!list.length) return;
+      // 5.4: refcount per LISTEN-owned uri; the upstream subscribe is sent on the 0->1 crossing
+      // only (a re-listen agreeing the same uri must not spam idempotent subscribes).
+      const fresh = [];
+      for (const uri of list) {
+        const n = this._subscribedRefs.get(uri) || 0;
+        this._subscribedRefs.set(uri, n + 1);
+        if (!this._subscribedUris.has(uri)) { this._subscribedUris.add(uri); fresh.push(uri); }
+      }
+      if (!fresh.length) return;
+      for (const [id, client] of this._clients) {
+        if (this.wrapChatterUpstream && id !== this.wrapChatterUpstream) continue;
+        if (!client || client.era !== 'legacy' || typeof client.request !== 'function') continue;
+        const caps = client.initializeResult && client.initializeResult.capabilities;
+        if (!(caps && caps.resources && caps.resources.subscribe)) continue;
+        for (const uri of fresh) client.request('resources/subscribe', { uri }).catch(() => {});
+      }
+    } catch (_e) { /* never throw */ }
+  }
+
+  /**
+   * Release LISTEN-owned resource subscriptions (the refcount leak's fix). Decrements each
+   * uri's refcount; on the 1->0 crossing the uri leaves the replay set and the upstream is told
+   * resources/unsubscribe (same scope rules as subscribeResources). ACCEPTED EDGE, documented:
+   * a uri subscribed BOTH by a listen agreement and a client's own wrap-forwarded
+   * resources/subscribe shares one upstream channel - when the last listen releases, the
+   * upstream unsubscribe fires and the recorded Set entry goes with it (the exotic overlap is
+   * not disambiguated). NEVER throws.
+   * @param {string[]} uris
+   */
+  releaseResources(uris) {
+    try {
+      const list = Array.isArray(uris) ? uris.filter((u) => typeof u === 'string' && u.length) : [];
+      if (!list.length) return;
+      const gone = [];
+      for (const uri of list) {
+        const n = this._subscribedRefs.get(uri) || 0;
+        if (n <= 1) {
+          if (n === 1) this._subscribedRefs.delete(uri);
+          if (this._subscribedUris.has(uri)) { this._subscribedUris.delete(uri); gone.push(uri); }
+        } else {
+          this._subscribedRefs.set(uri, n - 1);
+        }
+      }
+      if (!gone.length) return;
+      for (const [id, client] of this._clients) {
+        if (this.wrapChatterUpstream && id !== this.wrapChatterUpstream) continue;
+        if (!client || client.era !== 'legacy' || typeof client.request !== 'function') continue;
+        const caps = client.initializeResult && client.initializeResult.capabilities;
+        if (!(caps && caps.resources && caps.resources.subscribe)) continue;
+        for (const uri of gone) client.request('resources/unsubscribe', { uri }).catch(() => {});
+      }
+    } catch (_e) { /* never throw */ }
+  }
+
+  /** Replay the recorded resource subscriptions onto ONE freshly-connected upstream.
+   *  Called from _connectOne so every connect path - startup, lazy, background reconnect, reload -
+   *  re-arms the channel. Same scope rules as subscribeResources. Never throws. */
+  _replaySubscriptions(upstreamId) {
+    try {
+      if (!this._subscribedUris || this._subscribedUris.size === 0) return;
+      if (this.wrapChatterUpstream && upstreamId !== this.wrapChatterUpstream) return;
+      const client = this._clients.get(upstreamId);
+      if (!client || client.era !== 'legacy' || typeof client.request !== 'function') return;
+      const caps = client.initializeResult && client.initializeResult.capabilities;
+      if (!(caps && caps.resources && caps.resources.subscribe)) return;
+      for (const uri of this._subscribedUris) client.request('resources/subscribe', { uri }).catch(() => {});
+    } catch (_e) { /* never throw */ }
+  }
+
+  /** The change-notification methods an upstream may push that we bridge to modern clients. Anything
+   *  else from the upstream is ignored (request-scoped notifications ride their own request stream). */
+  static get BRIDGED_NOTIFICATIONS() {
+    return new Set([
+      'notifications/tools/list_changed',
+      'notifications/prompts/list_changed',
+      'notifications/resources/list_changed',
+      'notifications/resources/updated',
+    ]);
+  }
+
+  /**
+   * Forward a server-initiated CHANGE notification from an upstream to the transport hook, which
+   * fans it to modern subscriptions/listen streams. Only the known change methods pass; the
+   * notification is handed on verbatim (the transport tags + filters per subscription). NEVER
+   * throws (an onNotification handler must never break the client's read loop).
+   * @param {string} upstreamId
+   * @param {object} notification  a JSON-RPC notification { method, params? }
+   */
+  _forwardUpstreamNotification(upstreamId, notification) {
+    try {
+      if (this._closed) return; // a swapped-out/torn-down aggregator must never fan out
+      if (!notification || typeof notification.method !== 'string') return;
+      // Scoped progress: a beat carrying one of OUR tokens goes to that call's sink,
+      // caller's token restored - only from the upstream the token was issued to - and NOWHERE else:
+      // not a settled call, not another upstream's, never on to a broadcast.
+      if (notification.method === 'notifications/progress') {
+        const tok = notification.params && notification.params.progressToken;
+        if (typeof tok === 'string' && tok.startsWith(this._progressPrefix)) {
+          const route = this._progressRoutes.get(tok);
+          if (route && route.upstreamId === upstreamId) {
+            try { route.sink(Object.assign({}, notification.params, { progressToken: route.originalToken })); } catch (_e) { /* a sink never breaks the read loop */ }
+          }
+          return;
+        }
+      }
+      // tasks/status rides the wrap-chatter lane too: the wrap advertises the
+      // upstream's `tasks` capability verbatim, so a task started through the wrap owes its
+      // status notifications exactly as a direct connection would deliver them (2025-11-25
+      // schema TaskStatusNotification). Wrapped upstream only - same scope as message/progress.
+      const isWrapChatter = this.wrapChatterUpstream === upstreamId &&
+        (notification.method === 'notifications/message' || notification.method === 'notifications/progress' ||
+         notification.method === 'notifications/tasks/status');
+      if (!Aggregator.BRIDGED_NOTIFICATIONS.has(notification.method) && !isWrapChatter) return;
+      // Forward a CLEAN notification only - a misbehaving upstream's stray `id: null` field would
+      // read as a response to downstream parsers.
+      const clean = { jsonrpc: '2.0', method: notification.method };
+      if (notification.params !== undefined) clean.params = notification.params;
+      const emit = () => {
+        try {
+          if (typeof this.onUpstreamNotification === 'function') {
+            this.onUpstreamNotification(upstreamId, clean);
+          }
+        } catch (_e) { /* never let a bridged notification break the read loop */ }
+      };
+      if (notification.method === 'notifications/tools/list_changed') {
+        // A relayed "tools changed" must not point the client at a STALE surface - refresh the
+        // cache FIRST, then relay, so the re-fetch sees the new list. onToolsChanged
+        // fires too so ToolFunnel's own funnel-mode signal stays coherent.
+        this._listAndCache(upstreamId)
+          .then(() => { try { if (typeof this.onToolsChanged === 'function') this.onToolsChanged(); } catch (_e) { /* ignore */ } })
+          .catch(() => { /* refresh failed - still relay; the old cache is the best we have */ })
+          .then(emit);
+        return;
+      }
+      emit();
+    } catch (_e) { /* never let a bridged notification break the read loop */ }
+  }
+
+  /**
+   * The downstream name a discovered upstream tool is surfaced under: its ENABLED expose `as` if one
+   * exists for (upstream, tool), else the namespaced default `<upstream>_<tool>` (matching
+   * expose-store.exposedName). Keeps the lean list and the lean run path in agreement, and aligns an
+   * exposed tool's lean name with its curated-direct top-level name. Never throws.
+   * @param {string} upstreamId
+   * @param {string} toolName
+   * @returns {string}
+   */
+  _surfacedName(upstreamId, toolName) {
+    try {
+      const exposed = this._store.listExposed({ enabledOnly: true });
+      for (const e of exposed) {
+        if (e && e.upstream === upstreamId && e.tool === toolName) return this._store.exposedName(e);
+      }
+    } catch (_e) {
+      /* fall through to the default */
+    }
+    return `${upstreamId}_${toolName}`;
+  }
+
+  /**
+   * Connect an upstream ON DEMAND and return the ready McpClient. Idempotent + race-safe:
+   *   - fast path: a cached client that is still `connected` is returned as-is; a cached-but-DEAD
+   *     client (its child exited - McpClient flips `connected` but stays in the cache) is logged as a
+   *     disconnect, discarded, and reconnected - a reconnect re-lists the upstream's tools.
+   *   - concurrent callers JOIN the same in-flight connect promise (keyed in _connecting), which
+   *     resolves only AFTER _listAndCache - so no caller ever sees the half-built client that
+   *     _connectOne caches BEFORE the handshake completes (the double-spawn / mid-handshake race).
+   * Throws on an unknown/disabled upstream or a connect/list failure (the caller surfaces it; for the
+   * lean run path that means gatedRun returns { ok:false, error } cleanly).
+   * @param {string} upstreamId
+   * @returns {Promise<object>} the connected McpClient
+   */
+  async ensureConnected(upstreamId, opts) {
+    if (!isNonEmptyString(upstreamId)) throw new Error('Aggregator.ensureConnected: upstreamId (non-empty string) is required');
+    // allowConnect:false (the RUN path) must NEVER block on a connect - not a from-scratch connect
+    // (connect()+tools/list, ~20s, would freeze the serialized stdio chain and starve pings) AND not
+    // by JOINING an in-flight background reconnect (same latency). It returns a live client or fails
+    // clean; the background reconnect owns recovery and the run retries next turn. allowConnect
+    // defaults true (the background path connects / joins).
+    const allowConnect = !(opts && opts.allowConnect === false);
+    // allowDisabled: ONLY the discover path sets it - inspecting a disabled upstream's tools
+    // ("what does this have, before I enable it?") is a deliberate operator action that worked
+    // before discover was routed through here for the race fix. Every
+    // other caller keeps the refusal; a disabled upstream's tools stay OFF the lean surface
+    // regardless (leanToolDefinitions checks enabled itself).
+    const allowDisabled = !!(opts && opts.allowDisabled === true);
+    // A torn-down aggregator (swapped out by reloadExpose, then closeAll'd) must NEVER (re)connect:
+    // a captured execute thunk holding this instance would otherwise spawn an ORPHAN child on it.
+    if (this._closed) throw new Error('Aggregator.ensureConnected: aggregator is closed (config reloaded) - retry on the current one');
+
+    // A connect already in flight: JOIN it - BEFORE inspecting the cache. _connectOne caches the
+    // client pre-handshake, so a concurrent caller inspecting first sees `connected:false`, reads
+    // it as stale, closes it (killing the in-flight child mid-handshake) and then joins the
+    // connect it just doomed - both callers fail. The RUN path
+    // (allowConnect:false) still never joins - joining would block the stdio chain.
+    if (this._connecting.has(upstreamId)) {
+      if (!(opts && opts.allowConnect === false)) return this._connecting.get(upstreamId);
+      throw new Error(`Aggregator.ensureConnected: upstream "${upstreamId}" is not connected (reconnecting in background) - retry in a few seconds`);
+    }
+
+    // STOPPED (permanent failure past the ceiling): nothing is reconnecting, so the RUN path must
+    // not say it is - name the cause and the way back. The background path (an operator's
+    // discover) still makes its one attempt below.
+    const stopped = this._stopped.get(upstreamId);
+    if (stopped && !allowConnect) {
+      throw new Error(`Aggregator.ensureConnected: upstream "${upstreamId}" is not connected - stopped retrying after ` +
+        `${stopped.attempts} attempts: ${stopped.error}. Fix the cause, then save expose.json (any change reloads it) ` +
+        'or restart the gateway.');
+    }
+
+    // Fast path: a live cached client serves BOTH modes immediately.
+    const existing = this._clients.get(upstreamId);
+    if (existing) {
+      const alive = typeof existing.connected === 'boolean' ? existing.connected : true;
+      if (alive) return existing;
+      // Dead cached client. The RUN path fails clean (never (re)connects); the background path drops
+      // it and reconnects below.
+      if (!allowConnect) {
+        throw new Error(`Aggregator.ensureConnected: upstream "${upstreamId}" disconnected (reconnecting in background) - retry in a few seconds`);
+      }
+      logger.log({ type: 'mcp', event: 'disconnect', upstream: upstreamId, reason: 'stale' });
+      this._discard(upstreamId);
+    } else if (!allowConnect) {
+      // Not connected. The RUN path neither connects NOR joins an in-flight connect - joining would
+      // block the stdio chain for the connect+list latency (the head-of-line freeze this mode avoids).
+      throw new Error(`Aggregator.ensureConnected: upstream "${upstreamId}" is not connected (reconnecting in background) - retry in a few seconds`);
+    }
+
+    // Background path only (allowConnect): connect from scratch. In-flight connects were joined
+    // at the top of the method (before cache inspection - the mid-connect discard race); nothing
+    // between there and here awaits, so no new entry can have appeared.
+    const upstream = this._store.getUpstream(upstreamId);
+    if (!upstream) throw new Error(`Aggregator.ensureConnected: unknown upstream "${upstreamId}"`);
+    if (upstream.enabled !== true && !allowDisabled) throw new Error(`Aggregator.ensureConnected: upstream "${upstreamId}" is disabled`);
+
+    const promise = (async () => {
+      await this._connectOne(upstream); // caches client + tools, logs the connect
+      return this._clients.get(upstreamId);
+    })();
+    this._connecting.set(upstreamId, promise);
+    try {
+      return await promise;
+    } catch (err) {
+      this._discard(upstreamId); // reap the half-spawned child; leave no zombie/cache entry
+      throw err;
+    } finally {
+      this._connecting.delete(upstreamId);
+    }
+  }
+
+  /**
+   * Force a fresh connect of `upstreamId` presenting the CURRENT provider-supplied identity -
+   * the wrap identity-mirror's inline path. Settles any in-flight connect FIRST: discarding a
+   * half-built client and then joining its doomed promise leaves the upstream wedged with no
+   * background reconnect and no self-heal. Rejects
+   * like ensureConnected on failure.
+   */
+  async reconnect(upstreamId) {
+    if (!isNonEmptyString(upstreamId)) throw new Error('Aggregator.reconnect: upstreamId (non-empty string) is required');
+    while (this._connecting.has(upstreamId)) {
+      try { await this._connecting.get(upstreamId); } catch (_e) { /* settled is all we need */ }
+    }
+    this._discard(upstreamId);
+    // A MANUAL kick deliberately re-runs the full era negotiation - the operator may have just
+    // upgraded the server, and "reconnect" should observe reality, not replay a memo of it.
+    this._eraMemo.delete(upstreamId);
+    // ...and it restarts a STOPPED upstream with a fresh retry budget: the operator is saying the
+    // cause may be fixed (the command installed, the path moved inside the root).
+    this._stopped.delete(upstreamId);
+    this._permanentFailures.delete(upstreamId);
+    try {
+      return await this.ensureConnected(upstreamId);
+    } catch (err) {
+      // This path DESTROYED a (possibly healthy) connection, and the deliberate close means
+      // onClose never fires - without this, one transient connect failure leaves no client, no
+      // in-flight connect AND no retry timer: the upstream is wedged until an external kick
+      // while ensureConnected's "reconnecting in background" message lies. The destroyer owns the retry. A stale PENDING timer (a prior death's slow
+      // 30s keepalive) must be cleared first - _scheduleReconnect's one-timer guard would
+      // otherwise no-op and leave the upstream on the long window instead of the immediate
+      // retry this path promises.
+      const stale = this._reconnectTimers.get(upstreamId);
+      if (stale) { clearTimeout(stale); this._reconnectTimers.delete(upstreamId); }
+      if (!this._countConnectFailure(upstreamId, err)) this._scheduleReconnect(upstreamId, 0);
+      throw err;
+    }
+  }
+
+  /**
+   * UNEXPECTED upstream death (fired by McpClient.onClose). Log it, drop the dead client so it
+   * leaves the lean list, tell the client the tool set shrank, then schedule a BACKGROUND reconnect.
+   * Keeping recovery off the serialized stdio chain is what closes the head-of-line regression: a run
+   * during the down-window fails clean (ensureConnected allowConnect:false) instead of blocking.
+   * @param {string} upstreamId
+   */
+  _handleUpstreamDown(upstreamId) {
+    if (this._closed) return;
+    logger.log({ type: 'mcp', event: 'disconnect', upstream: upstreamId, reason: 'died' });
+    this._discard(upstreamId); // remove the dead client + its tools -> drops from the lean list
+    this._signalToolsChanged(upstreamId); // list_changed only if the upstream is on the top-level surface
+    // If a reconnect ATTEMPT is already executing, it owns the next backoff step (its catch escalates
+    // attempt+1). Seeding attempt-0 here would reset the delay to 1s on every mid-attempt death, and
+    // the one-timer guard would then swallow the attempt's escalation - a permanent 1s respawn loop.
+    // Only start a fresh cycle when no attempt is in flight (the ordinary first death of a live upstream).
+    if (this._reconnecting.has(upstreamId)) return;
+    this._scheduleReconnect(upstreamId, 0);
+  }
+
+  /**
+   * Does this upstream contribute to the TOP-LEVEL tools/list (i.e. has an ENABLED expose[] entry)?
+   * Only then does its death/recovery change tools/list and warrant a notifications/tools/list_changed.
+   * A lean-only upstream's tools live behind toolfunnel_list_tools (pulled per call), so notifying for
+   * one is spurious (the client re-fetches and sees no diff). Never throws.
+   * @param {string} upstreamId
+   * @returns {boolean}
+   */
+  _affectsTopLevel(upstreamId) {
+    try {
+      // Under a WRAP the wrapped upstream IS the entire top-level surface - its death/recovery
+      // changes tools/list even with an empty expose[] (a typical wrap has no expose
+      // entries, so death/recovery was silent and clients held a stale surface forever).
+      // wrapChatterUpstream mirrors the live wrap state (armed at boot, per message, on reload).
+      if (this.wrapChatterUpstream && this.wrapChatterUpstream === upstreamId) return true;
+      // Hot-promoted upstream tools sit on the funnel's top-level surface without an expose[]
+      // entry; the host injects this predicate (armWrapChatter) because promotion lives in the
+      // tool-state overlay the aggregator has no business reading directly.
+      if (typeof this.topLevelUpstreamExtra === 'function' && this.topLevelUpstreamExtra(upstreamId)) return true;
+      return this._store.listExposed({ enabledOnly: true }).some((e) => e && e.upstream === upstreamId);
+    } catch (_e) {
+      return false;
+    }
+  }
+
+  /** Fire onToolsChanged ONLY when the upstream is actually on the top-level surface (else the
+   *  notification is spurious - its lean tools refresh on the next toolfunnel_list_tools). Never throws. */
+  _signalToolsChanged(upstreamId) {
+    if (!this._affectsTopLevel(upstreamId)) return;
+    try { this.onToolsChanged(); } catch (_e) { /* never throw out of an event handler */ }
+  }
+
+  /**
+   * Count one failed connect toward the permanent-failure ceiling. A PERMANENT-class error adds to
+   * this upstream's consecutive count; any other error resets it. Past PERMANENT_RETRY_LIMIT retries
+   * the upstream is STOPPED: one stderr line, a log event, and stoppedUpstreams() lists it. NEVER throws.
+   * @returns {boolean} true when the upstream is now stopped (the caller must not schedule a retry)
+   */
+  _countConnectFailure(upstreamId, err) {
+    try {
+      if (!isPermanentConnectError(err)) {
+        this._permanentFailures.delete(upstreamId);
+        return false;
+      }
+      const attempts = (this._permanentFailures.get(upstreamId) || 0) + 1;
+      this._permanentFailures.set(upstreamId, attempts);
+      if (attempts <= PERMANENT_RETRY_LIMIT) return false;
+      // ONE bounded line: a real failure carries the upstream's stderr (newlines, possibly pages
+      // of it). The client puts the cause first, so the head is the part worth keeping.
+      const flat = errMsg(err).replace(/\s+/g, ' ').trim();
+      const error = flat.length > STOPPED_ERROR_MAX ? flat.slice(0, STOPPED_ERROR_MAX) + '...' : flat;
+      this._stopped.set(upstreamId, { error, attempts });
+      logger.log({ type: 'mcp', event: 'reconnect_stopped', upstream: upstreamId, attempts, error });
+      try {
+        process.stderr.write(`[toolfunnel] upstream "${upstreamId}" stopped retrying after ${attempts} attempts ` +
+          `(a permanent failure: ${error}). Fix the cause, then save expose.json (any change reloads it) or restart the gateway.\n`);
+      } catch (_e) { /* never let the notice sink the caller */ }
+      return true;
+    } catch (_e) {
+      return false;
+    }
+  }
+
+  /** Upstreams that hit the permanent-failure ceiling and stopped retrying: [{id, error, attempts}]
+   *  (fresh copies). The /health source. Never throws. */
+  stoppedUpstreams() {
+    const out = [];
+    for (const [id, s] of this._stopped) out.push({ id, error: s.error, attempts: s.attempts });
+    return out;
+  }
+
+  /**
+   * Schedule ONE background reconnect attempt with exponential backoff: 1s,2s,4s,8s,16s, then capped
+   * at 30s. After the fast phase it does NOT give up on a transient failure - it falls back to a slow
+   * 30s keepalive so a long transient outage still self-heals; a PERMANENT failure stops at the
+   * ceiling instead (_countConnectFailure) (a detached/disabled upstream stops it via getUpstream; closeAll
+   * stops it via _closed). On success the tools are re-listed and a top-level change is signalled. One
+   * timer per upstream (no pile-up); the timer is unref'd so it never keeps the process alive. NEVER throws.
+   * @param {string} upstreamId
+   * @param {number} attempt
+   */
+  _scheduleReconnect(upstreamId, attempt) {
+    if (this._closed) return;
+    if (this._reconnectTimers.has(upstreamId)) return; // a reconnect is already pending for this id
+    if (this._stopped.has(upstreamId)) return; // past the permanent-failure ceiling - see _countConnectFailure
+    const upstream = this._store.getUpstream(upstreamId);
+    if (!upstream || upstream.enabled !== true) return; // detached/disabled - stop trying
+    const MAX_FAST_ATTEMPTS = 6; // exponential phase; beyond it, a slow keepalive at the 30s cap
+    const delay = Math.min(1000 * Math.pow(2, attempt), 30000);
+    const timer = setTimeout(async () => {
+      this._reconnectTimers.delete(upstreamId);
+      if (this._closed) return;
+      const u = this._store.getUpstream(upstreamId);
+      if (!u || u.enabled !== true) return;
+      // Mark the attempt in flight so a death DURING ensureConnected's connect/list (onClose ->
+      // _handleUpstreamDown) does not re-seed attempt-0: THIS attempt's catch owns the escalation.
+      this._reconnecting.add(upstreamId);
+      try {
+        await this.ensureConnected(upstreamId); // allowConnect default - connects + re-lists, off-chain
+        logger.log({ type: 'mcp', event: 'reconnect', upstream: upstreamId, attempt });
+        this._signalToolsChanged(upstreamId);
+      } catch (err) {
+        logger.log({ type: 'mcp', event: 'reconnect_failed', upstream: upstreamId, attempt, error: errMsg(err) });
+        // Log the fast->slow transition exactly ONCE - when the counter FIRST reaches the cap. The
+        // old guard sat on the re-entry side, where the capped counter re-satisfied it every 30s
+        // forever against a permanently-dead upstream (log spam, not information).
+        if (attempt + 1 === MAX_FAST_ATTEMPTS) {
+          logger.log({ type: 'mcp', event: 'reconnect_slow', upstream: upstreamId, attempts: MAX_FAST_ATTEMPTS });
+        }
+        // A PERMANENT failure past the ceiling stops here (one stderr line; stoppedUpstreams()).
+        if (this._countConnectFailure(upstreamId, err)) return;
+        // Keep escalating to the cap, then keep retrying slowly (cap the counter so the delay stays
+        // at 30s) - never permanently give up while the upstream stays enabled. The escalation is
+        // scheduled while still in flight (the guard below checks _reconnectTimers, which is empty
+        // because a mid-attempt death was skipped) - the finally then releases the marker.
+        this._scheduleReconnect(upstreamId, Math.min(attempt + 1, MAX_FAST_ATTEMPTS));
+      } finally {
+        this._reconnecting.delete(upstreamId);
+      }
+    }, delay);
+    if (timer && typeof timer.unref === 'function') timer.unref();
+    this._reconnectTimers.set(upstreamId, timer);
+  }
+
+  /**
+   * The LEAN tool definitions: every discovered tool of every CONNECTED + enabled upstream, surfaced
+   * for toolfunnel_list_tools. Each: { name, description, inputSchema, upstream, tool }. The FULL
+   * discovered set (not just expose[]) - attaching an MCP makes its tools appear leanly with no
+   * curation. Only connected upstreams contribute (we need their real schemas); a not-yet-connected
+   * upstream's tools simply appear once it connects (the next list call reflects it - no
+   * notification needed, the lean surface is delivered inside a per-call meta-tool). Never throws.
+   * @returns {Array<{name:string, description:string, inputSchema:object, upstream:string, tool:string}>}
+   */
+  leanToolDefinitions() {
+    const defs = [];
+    const seen = new Set(); // surfaced-name collision guard - the list must agree with resolve (first wins)
+    try {
+      for (const [upstreamId, tools] of this._tools) {
+        if (!this._clients.has(upstreamId)) continue; // connected only
+        const upstream = this._store.getUpstream(upstreamId);
+        if (upstream && upstream.enabled === false) continue; // skip an explicitly-disabled upstream
+        if (!Array.isArray(tools)) continue;
+        for (const t of tools) {
+          if (!t || !isNonEmptyString(t.name)) continue;
+          const name = this._surfacedName(upstreamId, t.name);
+          if (seen.has(name)) {
+            // Two tools collapse to one surfaced name (underscore ambiguity, or a duplicate `as`).
+            // resolveLeanExecution returns the FIRST match, so advertise only the first - the list
+            // must never show a name that resolves to a different tool. Log the shadowing.
+            logger.log({ type: 'mcp', event: 'name_collision', upstream: upstreamId, tool: t.name, surfaced: name });
+            continue;
+          }
+          seen.add(name);
+          const schema = t.inputSchema && typeof t.inputSchema === 'object' ? t.inputSchema : { type: 'object' };
+          defs.push(withForwardedToolMeta({
+            name,
+            description: isNonEmptyString(t.description) ? t.description : '',
+            inputSchema: sanitiseXMcpHeaders(cloneJson(schema)),
+            upstream: upstreamId,
+            tool: t.name,
+          }, t));
+        }
+      }
+    } catch (_e) {
+      /* never throw out of a definition build - return what we have */
+    }
+    return defs;
+  }
+
+  /**
+   * Resolve a lean downstream name + args into a forwarding executor for toolfunnel_run_tool. Matches
+   * by ITERATION over discovered tools (computing each tool's surfaced name) - never by parsing the
+   * name (underscore-ambiguous). The execute thunk lazy-(re)connects via ensureConnected and UNWRAPS
+   * the upstream MCP envelope to a clean payload, so run_tool returns the upstream's content (e.g.
+   * "pong"), not a stringified envelope. The connect is INSIDE the thunk -> a PreToolUse deny spawns
+   * nothing. The gate matches `toolName` (the surfaced name). Returns null if no connected + enabled
+   * upstream advertises a tool with this surfaced name (-> protocol's clean "not runnable" error) -
+   * the same connected/enabled predicate leanToolDefinitions lists by, so hidden means not runnable.
+   * @param {string} name surfaced downstream name
+   * @param {any}    args
+   * @returns {{ execute: () => Promise<any>, toolName: string, upstream: string } | null}
+   */
+  resolveLeanExecution(name, args, callOpts) {
+    if (!isNonEmptyString(name)) return null;
+    // callOpts: { meta, progress } - the caller's request _meta rides the lean forward as it does
+    // every other route, and progress comes back through the sink.
+    const leanMeta = callOpts && callOpts.meta && typeof callOpts.meta === 'object' ? callOpts.meta : undefined;
+    const leanProgress = callOpts && typeof callOpts.progress === 'function' ? callOpts.progress : undefined;
+    for (const [upstreamId, tools] of this._tools) {
+      if (!this._clients.has(upstreamId)) continue;
+      const upstream = this._store.getUpstream(upstreamId);
+      if (upstream && upstream.enabled === false) continue; // skip an explicitly-disabled upstream
+      if (!Array.isArray(tools)) continue;
+      for (const t of tools) {
+        if (!t || !isNonEmptyString(t.name)) continue;
+        if (this._surfacedName(upstreamId, t.name) !== name) continue;
+        const realTool = t.name;
+        const self = this;
+        const execute = async () => {
+          // A changed descriptor waiting for acceptance refuses here, before any forward.
+          const refusal = self._approvalRefusal(upstreamId, realTool, 'lean');
+          if (refusal) throw Object.assign(new Error(refusal.text), { withheld: refusal.envelope.structuredContent });
+          // allowConnect:false - the run path NEVER synchronously (re)connects (that would freeze the
+          // stdio loop, starving pings). It uses a live client or joins an in-flight background
+          // reconnect, else fails clean; the onClose-driven background reconnect owns recovery.
+          const client = await self.ensureConnected(upstreamId, { allowConnect: false });
+          self._warnIfPinned(upstreamId, realTool);
+          const scoped = self._scopeProgress(upstreamId, leanMeta, leanProgress);
+          let envelope;
+          try {
+            envelope = await client.callTool(realTool, args, scoped.meta);
+          } finally {
+            scoped.release();
+          }
+          // Preserve the upstream's failure signal. callTool RESOLVES even on isError:true, so a
+          // failed upstream call must become a THROW -> gatedRun returns { ok:false } -> run_tool
+          // surfaces isError:true. Otherwise a failed call would be reported as success - and the
+          // lean path must agree with curated-direct's isError passthrough.
+          const payload = unwrapEnvelope(envelope);
+          if (envelope && typeof envelope === 'object' && envelope.isError === true) {
+            const text = typeof payload === 'string' ? payload : safeStringify(payload);
+            const err = new Error(text && text.length ? text : 'upstream tool reported an error');
+            err.upstreamToolError = true;
+            throw err;
+          }
+          return payload;
+        };
+        return { execute, toolName: name, upstream: upstreamId };
+      }
+    }
+    return null;
+  }
+
+  /**
+   * resolveRawExecution - the passthrough (WRAP) twin of resolveLeanExecution. Its execute returns
+   * the upstream's tools/call result VERBATIM - multi-block content, isError, structuredContent
+   * and any future fields untouched. A wrapped client must receive exactly what a direct client
+   * would; the lean unwrap (single text block, throw-on-isError) destroys that. No unwrap, no
+   * throw-on-isError: the envelope IS the product. Uses client.request() so a modern upstream
+   * gets its per-request _meta trio.
+   * @param {string} name surfaced downstream name
+   * @param {any}    args
+   * @returns {{ execute: () => Promise<any>, toolName: string, upstream: string } | null}
+   */
+  resolveRawExecution(name, args, meta, out, progress) {
+    if (!isNonEmptyString(name)) return null;
+    for (const [upstreamId, tools] of this._tools) {
+      if (!this._clients.has(upstreamId)) continue;
+      const upstream = this._store.getUpstream(upstreamId);
+      if (upstream && upstream.enabled === false) continue; // skip an explicitly-disabled upstream
+      if (!Array.isArray(tools)) continue;
+      for (const t of tools) {
+        if (!t || !isNonEmptyString(t.name)) continue;
+        if (this._surfacedName(upstreamId, t.name) !== name) continue;
+        const realTool = t.name;
+        const self = this;
+        const execute = async () => {
+          // A changed descriptor waiting for acceptance refuses here (the wrap has no meta-tools, so
+          // the result names the UI and CLI routes).
+          const refusal = self._approvalRefusal(upstreamId, realTool, 'raw');
+          if (refusal) return refusal.envelope;
+          // allowConnect:false - same freeze-avoidance rule as the lean path.
+          const client = await self.ensureConnected(upstreamId, { allowConnect: false });
+          self._warnIfPinned(upstreamId, realTool);
+          const params = { name: realTool, arguments: args == null ? {} : args };
+          // The caller's request-scoped _meta (progressToken, trace keys - already stripped of
+          // protocol keys) rides the forward: a direct server would receive it, so the wrapped
+          // one must too - without it the upstream never emits progress for the call. With a
+          // progress sink the token is scoped to this call (_scopeProgress).
+          const scoped = self._scopeProgress(upstreamId, meta, progress);
+          if (scoped.meta && typeof scoped.meta === 'object' && Object.keys(scoped.meta).length) params._meta = scoped.meta;
+          // `out.rpcId` is set synchronously at issue time - the caller's cancel-translation
+          // hook (the same contract as forwardRaw's).
+          try {
+            return await client.request('tools/call', params, out);
+          } finally {
+            scoped.release();
+          }
+        };
+        return { execute, toolName: name, upstream: upstreamId };
+      }
+    }
+    return null;
+  }
+
+  /**
+   * Close every cached client and clear the caches. Idempotent - safe to call twice and
+   * safe when nothing was ever connected. NEVER throws (close() on McpClient never throws).
+   * @returns {Promise<void>}
+   */
+  async closeAll() {
+    this._closed = true; // latch BEFORE teardown so any in-flight execute thunk refuses to re-spawn
+    LIVE_WRITERS.delete(this._writer.id);
+    for (const [, timer] of this._reconnectTimers) {
+      try { clearTimeout(timer); } catch (_e) { /* ignore */ }
+    }
+    this._reconnectTimers.clear();
+    this._reconnecting.clear(); // no in-flight attempt survives teardown (its finally is a no-op then)
+    for (const [id, client] of this._clients) {
+      try {
+        if (client && typeof client.close === 'function') client.close();
+        // Activity log (self-gating): the disconnect half. A reload closes the old aggregator here,
+        // so a reconnect reads as a disconnect line followed by a connect line for the same id.
+        logger.log({ type: 'mcp', event: 'disconnect', upstream: id });
+      } catch (_e) {
+        /* McpClient.close never throws, but never let teardown sink the loop */
+      }
+    }
+    this._clients.clear();
+    this._tools.clear();
+    this._rawTools.clear();
+    this._pending.clear();
+    this._withheld.clear();
+    this._invalid.clear();
+    this._progressRoutes.clear();
+  }
+
+  // ── internals ──────────────────────────────────────────────────────────────
+
+  /**
+   * Connect a single upstream entry and cache the client + its discovered tools.
+   * Throws on factory (isolation), connect, or listTools failure - callers decide
+   * whether to collect (connectAll) or surface (discover) the error. On throw, the
+   * caller is responsible for _discard()-ing the id.
+   * @param {object} upstream  a normalised ExposeStore upstream
+   */
+  async _connectOne(upstream) {
+    // The factory may throw (isolation guard) - that propagates out as a connect failure. Pass an
+    // onClose so an UNEXPECTED upstream death triggers a BACKGROUND reconnect (not a lazy one in the
+    // run path, which would freeze the stdio chain).
+    const client = this._clientFactory(upstream, () => this._handleUpstreamDown(upstream.id));
+    if (!client || typeof client.connect !== 'function') {
+      throw new Error(`clientFactory returned an invalid client for "${upstream.id}"`);
+    }
+    // Bridge this upstream's server-initiated change-notifications to the transport (which fans them
+    // out to modern subscriptions/listen streams). Filtered to the known change methods so arbitrary
+    // upstream chatter never reaches a client. NEVER throws.
+    client.onNotification = (n) => this._forwardUpstreamNotification(upstream.id, n);
+    // Elicitation bridge: surface server-initiated requests with the upstream id + the live client (the
+    // handler answers on it). Guarded so a handler bug can never break the client's read loop.
+    client.onServerRequest = (m) => {
+      try {
+        if (this._closed) { client.respondToServerError(m.id, -32603, 'shutting down'); return; }
+        this.onUpstreamServerRequest(upstream.id, m, client);
+      } catch (_e) {
+        try { client.respondToServerError(m.id, -32603, 'request failed'); } catch (_e2) { /* ignore */ }
+      }
+    };
+    // Cache the client BEFORE connect so a connect-failure path can still _discard() and
+    // close any half-spawned child.
+    this._clients.set(upstream.id, client);
+    try {
+      await client.connect();
+      // The LIST is part of the connect contract: a handshake that cannot list its tools is a
+      // FAILED connect to every caller, and the era observation must not outlive it either.
+      await this._listAndCache(upstream.id);
+    } catch (err) {
+      // The failed attempt may have been era-HINTED (probe skipped on the memo). Whatever the
+      // cause - handshake or the post-handshake list - a failure invalidates the observation:
+      // clear it so the NEXT attempt re-runs the full negotiation. An upstream upgraded to
+      // modern-only across a restart recovers on the following backoff retry instead of failing
+      // hinted forever.
+      this._eraMemo.delete(upstream.id);
+      throw err;
+    }
+    // Remember the negotiated era so a death-driven reconnect can skip the probe (eraHint) - but
+    // only a DEFINITIVE observation (the probe was ANSWERED). A probe that timed out proves
+    // nothing about the upstream's eras, and memoising that fallback would pin a merely-SLOW
+    // dual-era upstream to legacy on every future reconnect. A hinted connect (probe skipped)
+    // leaves the existing memo in place.
+    if (client.eraDefinitive !== false) this._eraMemo.set(upstream.id, client.era);
+    // Re-arm any agreed resource subscriptions on the fresh process - every connect
+    // path funnels through here, so reconnects and reloads replay uniformly.
+    this._replaySubscriptions(upstream.id);
+    // Activity log (self-gating; no-op unless logging is enabled): the upstream half of connect
+    // logging. EVERY connect flows through here - startup connectAll, a live reload, a lazy
+    // discover, and (later) a health-driven reconnect - so all of them are logged uniformly.
+    logger.log({
+      type: 'mcp',
+      event: 'connect',
+      upstream: upstream.id,
+      command: upstream.command,
+      tools: (this._tools.get(upstream.id) || []).length,
+    });
+    // A connect that worked ends any permanent-failure count or stop (every connect path runs here).
+    this._permanentFailures.delete(upstream.id);
+    this._stopped.delete(upstream.id);
+    // Legacy shim STARTUP warning (the pin's contract: warn at startup AND per call, naming the
+    // version). stderr, so the operator sees it without the client's content ever growing.
+    if (upstream.legacyPin === true) {
+      try {
+        process.stderr.write(
+          `[toolfunnel] legacy shim: upstream "${upstream.id}" is PINNED to MCP ${LEGACY_UPSTREAM_VERSION} ` +
+            '(legacyPin) - this gateway keeps it working for modern clients; it cannot speak 2026-07-28 itself.\n'
+        );
+      } catch (_e) { /* never let a warning sink a connect */ }
+      logger.log({ type: 'mcp', event: 'legacy_shim_connect', upstream: upstream.id, protocolVersion: LEGACY_UPSTREAM_VERSION });
+    }
+  }
+
+  /** tools/list one connected upstream and cache the result; returns a clone of what is SERVED. */
+  async _listAndCache(upstreamId) {
+    const client = this._clients.get(upstreamId);
+    if (!client) throw new Error(`no connected client for "${upstreamId}"`);
+    const tools = await client.listTools();
+    const safe = Array.isArray(tools) ? tools.filter((t) => t && isNonEmptyString(t.name)) : [];
+    // Every descriptor enters here (connect, discover, list_changed). Drop structurally broken tools
+    // FIRST (one bad tool never takes the upstream down), then keep the RAW listing and SERVE only
+    // approved descriptors: every listing reads _tools, so none can show unapproved text.
+    this._rawTools.set(upstreamId, this._dropInvalidTools(upstreamId, safe));
+    this._applyApprovals(upstreamId, { fresh: true });
+    return cloneTools(this._tools.get(upstreamId) || []);
+  }
+
+  /** Split a listing into servable tools and dropped ones (toolSchemaProblem); record the dropped
+   *  for invalidTools() and name each once on stderr. NEVER throws. */
+  _dropInvalidTools(upstreamId, tools) {
+    const keep = [];
+    const dropped = [];
+    for (const t of tools) {
+      let problem;
+      try { problem = toolSchemaProblem(t); } catch (err) { problem = `cannot be checked (${errMsg(err)})`; }
+      if (!problem) { keep.push(t); continue; }
+      dropped.push({ tool: t.name, problem });
+      this._approvalNotice(`invalid:${upstreamId}:${t.name}:${problem}`,
+        `[toolfunnel] upstream "${upstreamId}": dropped tool ${JSON.stringify(t.name)} - ${problem}. ` +
+        'Its other tools are unaffected; the tool returns when the server fixes its descriptor.');
+    }
+    this._invalid.set(upstreamId, dropped);
+    if (dropped.length) logger.log({ type: 'mcp', event: 'tool_dropped', upstream: upstreamId, tools: dropped });
+    return keep;
+  }
+
+  /** Tools dropped by schema validation: [{upstream, tool, problem}] (fresh copies; the /health source). */
+  invalidTools() {
+    const out = [];
+    for (const [upstream, list] of this._invalid) for (const d of list) out.push({ upstream, tool: d.tool, problem: d.problem });
+    return out;
+  }
+
+  // ── tool descriptor approval ────────────────────────────────────────────────────────────────
+
+  /**
+   * Apply the approval rules (tool-approvals.js evaluate) to one upstream's RAW listing: fill _tools
+   * with what may be served and _pending with what must refuse, persist a changed record, report on
+   * stderr. An unreadable approvals file WITHHOLDS the upstream's tools (fail closed): treating it as
+   * empty would approve everything as first use. NEVER throws.
+   *
+   * Only a FRESH listing ({fresh: true}, from _listAndCache) - or a first use, with no record yet -
+   * WRITES the file and reports events. Every other call (the file watcher, a refusal's re-read, an
+   * accept) only re-derives what this process serves: gateways sharing a home each run their own
+   * child of the upstream, and a write from one's cached listing would erase another's pending
+   * entry or reverse its upgrade, each write waking the other's watcher.
+   * A write keeps other processes' pending entries (tool-approvals keepForeignPending).
+   */
+  _applyApprovals(upstreamId, opts) {
+    const fresh = !!(opts && opts.fresh);
+    const raw = this._rawTools.get(upstreamId) || [];
+    const withhold = (key, line) => {
+      this._withheld.add(upstreamId);
+      this._tools.set(upstreamId, []);
+      this._pending.set(upstreamId, new Map());
+      this._approvalNotice(key, line);
+    };
+    let doc;
+    try {
+      doc = approvals.loadApprovals(this._approvalsPath);
+    } catch (err) {
+      withhold(`unreadable:${upstreamId}`, `[toolfunnel] ${errMsg(err)} - the tools of upstream "${upstreamId}" are withheld ` +
+        'until mcp/tool-approvals.json is repaired (or that upstream\'s entry removed from it - removing an entry approves its current tools as first use).');
+      return;
+    }
+    this._approvalNoticed.delete(`unreadable:${upstreamId}`); // readable again: a later breakage reports anew
+    const client = this._clients.get(upstreamId);
+    const serverInfo = (client && client.initializeResult && client.initializeResult.serverInfo) || {};
+    const upstream = this._store.getUpstream(upstreamId);
+    const stored = approvals.getRecord(doc, upstreamId) || this._unsaved.get(upstreamId);
+    const authoritative = fresh || !stored;
+    let r;
+    try {
+      r = approvals.evaluate({
+        record: stored,
+        serverInfo,
+        tools: raw,
+        strict: !!(upstream && upstream.strictApproval === true),
+        writer: this._writer,
+      });
+    } catch (err) {
+      // A descriptor the hash cannot walk (nesting deep enough to exhaust the stack) is not served.
+      withhold(`unhashable:${upstreamId}`, `[toolfunnel] cannot check the tool descriptors of upstream "${upstreamId}" ` +
+        `(${errMsg(err)}) - its tools are withheld.`);
+      return;
+    }
+    const before = this._pending.get(upstreamId);
+    this._withheld.delete(upstreamId);
+    this._tools.set(upstreamId, r.effective);
+    this._pending.set(upstreamId, new Map(r.pending.map((p) => [p.tool, p])));
+    if ((r.changed || this._unsaved.has(upstreamId)) && authoritative) { // an unsaved record retries
+      try {
+        // Read-modify-write the CURRENT file: the UI, the CLI and other gateways write it too.
+        const latest = approvals.loadApprovals(this._approvalsPath);
+        const current = approvals.getRecord(latest, upstreamId);
+        const mine = this._ownPending.get(upstreamId) || new Set();
+        const merged = approvals.keepForeignPending(current, r.record, (n, h) => mine.has(`${n}@${h}`), writerAlive);
+        if (!current || approvals.canonical(current) !== approvals.canonical(merged)) {
+          approvals.setRecord(latest, upstreamId, merged);
+          try {
+            approvals.saveApprovals(this._approvalsPath, latest);
+          } catch (err) {
+            this._unsaved.set(upstreamId, merged);
+            throw err;
+          }
+        }
+        this._unsaved.delete(upstreamId);
+        this._approvalNoticed.delete(`save:${upstreamId}`); // saved again: a later failure reports anew
+        this._ownPending.set(upstreamId, new Set(Object.keys(r.record.pending || {}).map((n) => `${n}@${r.record.pending[n].hash}`)));
+      } catch (err) {
+        if (!this._unsaved.has(upstreamId)) this._unsaved.set(upstreamId, r.record);
+        this._approvalNotice(`save:${upstreamId}`, `[toolfunnel] could not save tool approvals for upstream "${upstreamId}": ` +
+          `${errMsg(err)} - approvals are kept in memory until a save succeeds (changes still wait for acceptance).`);
+      }
+    }
+    // Events (first use, upgrade, server change) are decisions, reported once, when they are made.
+    this._reportApprovals(upstreamId, authoritative ? r : { ...r, events: [] }, before, serverInfo);
+  }
+
+  /** stderr + activity log for what an evaluation did. Pending changes are reported when the SET changes. */
+  _reportApprovals(upstreamId, r, before, serverInfo) {
+    const label = (s) => `${s.name || 'unnamed server'}${s.version ? ' ' + s.version : ''}`;
+    const say = (line) => { try { process.stderr.write(approvals.printable(line) + '\n'); } catch (_e) { /* never sink the caller */ } };
+    for (const e of r.events) {
+      logger.log({ type: 'mcp', event: 'tool_approval', kind: e.kind, upstream: upstreamId, from: e.from, to: e.to, tools: e.tools });
+      if (e.kind === 'first-use') {
+        say(`[toolfunnel] upstream "${upstreamId}": approved ${e.tools.length} tool descriptor(s) on first use (${label(serverInfo)}). ` +
+          'A later change at the same server version will wait for your acceptance.');
+      } else if (e.kind === 'server-changed') {
+        say(`[toolfunnel] upstream "${upstreamId}" now reports a DIFFERENT server ("${e.from}" -> "${e.to}"): approved the new ` +
+          'descriptor(s) of ' + e.tools.map((t) => `${t.tool} (${t.reason})`).join(', ') +
+          '. If you did not change this upstream\'s command, check it (strictApproval holds such changes for acceptance).');
+        this._recordApprovalEvent({ upstream: upstreamId, kind: 'server-changed', from: e.from, to: e.to, tools: e.tools });
+      } else if (e.kind === 'upgrade') {
+        say(`[toolfunnel] upstream "${upstreamId}" upgraded from ${e.from} to ${e.to}: approved the new descriptor(s) of ` +
+          e.tools.map((t) => `${t.tool} (${t.reason})`).join(', ') + '.');
+        this._recordApprovalEvent({ upstream: upstreamId, kind: 'upgrade', from: e.from, to: e.to, tools: e.tools });
+      }
+    }
+    const sig = (list) => list.map((p) => `${p.tool}@${p.hash}`).sort().join('|');
+    const now = sig(r.pending);
+    if (r.pending.length && now !== sig(before ? [...before.values()] : [])) {
+      const version = serverInfo && serverInfo.version;
+      const stayed = !version || (r.record && r.record.server && r.record.server.version === version);
+      say(`[toolfunnel] upstream "${upstreamId}": ${r.pending.length} tool(s) changed ` +
+        (stayed ? `while the server version stayed ${version || '(not reported)'}` : `with the server upgrade to ${version} (strictApproval)`) +
+        ' - withheld until accepted: ' + r.pending.map((p) => `${p.tool} (${p.reason})`).join(', ') +
+        `. Review, then accept with the tf_accept_change tool, the UI, or: toolfunnel accept ${upstreamId}`);
+      logger.log({ type: 'mcp', event: 'tool_approval', kind: 'pending', upstream: upstreamId, tools: r.pending.map((p) => ({ tool: p.tool, reason: p.reason })) });
+    }
+  }
+
+  _recordApprovalEvent(e) {
+    this._approvalEvents.push(Object.assign({ at: new Date().toISOString() }, e));
+    if (this._approvalEvents.length > 50) this._approvalEvents.splice(0, this._approvalEvents.length - 50);
+  }
+
+  _approvalNotice(key, line) {
+    if (this._approvalNoticed.has(key)) return;
+    this._approvalNoticed.add(key);
+    try { process.stderr.write(approvals.printable(line) + '\n'); } catch (_e) { /* never sink the caller */ }
+  }
+
+  /**
+   * The refusal for a call to a tool whose changed descriptor waits for acceptance, or null.
+   * `route`: 'lean' (text for a thrown error), 'curated' / 'raw' (an isError envelope). The wrap
+   * ('raw') has no meta-tools, so it names only the UI and CLI routes.
+   * @returns {{ text: string, envelope: object } | null}
+   */
+  _approvalRefusal(upstreamId, realTool, route) {
+    const waiting = this._pending.get(upstreamId);
+    // Fast path: nothing waits for this tool AND the upstream is not withheld. A withheld upstream
+    // has an EMPTY pending map, so without the flag a call resolved while its tool was pending (one
+    // held at a permission prompt) would run once the watcher withheld it.
+    if (!this._withheld.has(upstreamId) && (!waiting || !waiting.has(realTool))) return null;
+    // The rare path, so re-read the approvals file first: an accept written by the UI, the CLI or a
+    // management script (another process) counts from the very NEXT call, not from whenever the
+    // file watcher fires.
+    if (this._rawTools.has(upstreamId)) {
+      const before = safeStringify(this._tools.get(upstreamId) || []);
+      this._applyApprovals(upstreamId);
+      if (safeStringify(this._tools.get(upstreamId) || []) !== before) this._signalToolsChanged(upstreamId);
+    }
+    const m = this._pending.get(upstreamId);
+    const p = m && m.get(realTool);
+    if (!p) {
+      // Released by the re-read - unless it is no longer SERVED at all (the file turned unreadable,
+      // which withholds the upstream, or the tool left the listing). Never fail open on that.
+      if ((this._tools.get(upstreamId) || []).some((t) => t && t.name === realTool)) return null;
+      const text = `ToolFunnel withheld this call: the tool ${JSON.stringify(realTool)} on upstream ${JSON.stringify(upstreamId)} ` +
+        'is not approved right now (its approvals could not be read, or the server no longer lists it). See the gateway log.';
+      return { text, envelope: { content: [{ type: 'text', text }], structuredContent: { toolfunnel: 'tool-withheld', upstream: upstreamId, tool: realTool }, isError: true } };
+    }
+    const arg = (s) => (/^[A-Za-z0-9_.:@/-]+$/.test(s) ? s : JSON.stringify(s));
+    const client = this._clients.get(upstreamId);
+    const version = client && client.initializeResult && client.initializeResult.serverInfo && client.initializeResult.serverInfo.version;
+    const cli = `toolfunnel accept ${arg(upstreamId)} ${arg(realTool)} --hash ${p.hash}`;
+    const acceptArgs = { upstream: upstreamId, tool: realTool, hash: p.hash };
+    // The new text is never quoted here: an unapproved description is the attack, so it must not
+    // reach the model's context through the refusal either. The user reviews it in the CLI or UI.
+    const text = [
+      `ToolFunnel withheld this call: the tool ${JSON.stringify(realTool)} on upstream ${JSON.stringify(upstreamId)} ` +
+        `${p.reason === 'new' ? 'is new since its server was approved' : 'changed since it was approved'} (server version ${version || 'not reported'}).`,
+      'That can be a legitimate update or a tampered server. Ask the user before accepting it.',
+      `Changed: ${p.changed.join(', ')}. The user can review the new text with \`toolfunnel changes\` or in the ToolFunnel UI.`,
+      // The agent route is a MANAGEMENT tool run through toolfunnel_run_tool, not a fifth meta-tool:
+      // the public surface stays at four.
+      route === 'raw'
+        ? `To accept it after the user agrees: the ToolFunnel UI, or run: ${cli}`
+        : 'To accept it after the user agrees: run the tool tf_accept_change - toolfunnel_run_tool with ' +
+          `${JSON.stringify({ name: 'tf_accept_change', args: acceptArgs })} - or use the ToolFunnel UI, or run: ${cli}`,
+    ].join('\n');
+    const structuredContent = {
+      toolfunnel: 'tool-change-withheld',
+      upstream: upstreamId,
+      tool: realTool,
+      reason: p.reason,
+      serverVersion: version || null,
+      changed: p.changed,
+      hash: p.hash,
+      accept: route === 'raw' ? { cli } : { tool: 'tf_accept_change', via: 'toolfunnel_run_tool', arguments: acceptArgs, cli },
+    };
+    return { text, envelope: { content: [{ type: 'text', text }], structuredContent, isError: true } };
+  }
+
+  /** Accept one held change, only while it is still the one at `expectHash`, and re-apply it here.
+   *  The MRTR route - the UI, the CLI and tf_accept_change write the file from their own process.
+   *  @returns the acceptInFile result. Throws on an unreadable approvals file. */
+  acceptChange(upstreamId, toolName, expectHash) {
+    const res = approvals.acceptInFile(this._approvalsPath, upstreamId, toolName, expectHash);
+    if (res.accepted.length) {
+      logger.log({ type: 'mcp', event: 'tool_approval', kind: 'accepted', upstream: upstreamId, tools: res.accepted });
+      try { process.stderr.write(approvals.printable(`[toolfunnel] accepted the changed descriptor(s) of upstream "${upstreamId}": ${res.accepted.join(', ')}.`) + '\n'); } catch (_e) { /* ignore */ }
+      this.reloadApprovals();
+    }
+    return res;
+  }
+
+  /** Re-apply approvals to every listed upstream (the approvals file changed on disk - a UI or CLI
+   *  accept). Signals a surface change for each upstream whose served tools changed. NEVER throws. */
+  reloadApprovals() {
+    for (const upstreamId of [...this._rawTools.keys()]) {
+      try {
+        const before = safeStringify(this._tools.get(upstreamId) || []);
+        this._applyApprovals(upstreamId);
+        if (safeStringify(this._tools.get(upstreamId) || []) !== before) this._signalToolsChanged(upstreamId);
+      } catch (_e) { /* one upstream never blocks the rest */ }
+    }
+  }
+
+  /** What waits for acceptance, and recent upgrades - the /health, CLI and UI source. Fresh copies. */
+  toolChanges() {
+    const pending = [];
+    for (const [upstream, m] of this._pending) {
+      for (const p of m.values()) pending.push({ upstream, tool: p.tool, reason: p.reason, changed: p.changed, hash: p.hash });
+    }
+    return { pending, upgraded: this._approvalEvents.map((e) => JSON.parse(JSON.stringify(e))) };
+  }
+
+  /** Tear down + forget a cached client (used on a failed connect). Never throws. */
+  _discard(upstreamId) {
+    const client = this._clients.get(upstreamId);
+    if (client && typeof client.close === 'function') {
+      try { client.close(); } catch (_e) { /* never throw */ }
+    }
+    this._clients.delete(upstreamId);
+    this._tools.delete(upstreamId);
+    this._rawTools.delete(upstreamId);
+    this._pending.delete(upstreamId);
+    this._withheld.delete(upstreamId);
+    this._invalid.delete(upstreamId);
+  }
+
+  /**
+   * Shared lookup behind isExposed / resolveExposedExecution: find the ENABLED expose
+   * entry whose downstream name === `name`, whose upstream is connected AND enabled, and
+   * whose real tool the upstream advertises. Returns the resolution context or null.
+   * @param {string} name
+   * @returns {{ client:object, realTool:string, upstream:string, exposedName:string } | null}
+   */
+  _findExposedExecution(name) {
+    if (!isNonEmptyString(name)) return null;
+    let exposed;
+    try {
+      exposed = this._store.listExposed({ enabledOnly: true });
+    } catch (_err) {
+      return null;
+    }
+    for (const e of exposed) {
+      if (!e) continue;
+      if (this._store.exposedName(e) !== name) continue;
+      const client = this._clients.get(e.upstream);
+      if (!client) continue; // upstream not connected
+      const upstream = this._store.getUpstream(e.upstream);
+      if (upstream && upstream.enabled === false) continue; // skip an explicitly-disabled upstream
+      const upstreamTools = this._tools.get(e.upstream) || [];
+      if (!upstreamTools.some((t) => t && t.name === e.tool)) continue; // tool not advertised
+      return { client, realTool: e.tool, upstream: e.upstream, exposedName: name };
+    }
+    return null;
+  }
+}
+
+// ── small helpers (no external deps) ───────────────────────────────────────────
+
+/** Extract a clean message from any thrown value. */
+function errMsg(err) {
+  return (err && err.message) || String(err);
+}
+
+/** JSON.stringify that never throws (circular/oddball values fall back to String). */
+function safeStringify(value) {
+  try { return JSON.stringify(value); } catch (_e) { return String(value); }
+}
+
+/**
+ * Turn an upstream MCP tools/call envelope { content:[...], isError? } into a clean payload for the
+ * LEAN run path. A single text block -> its string (so toolfunnel_run_tool returns "pong", matching
+ * what the curated-direct content passthrough surfaces); otherwise the content array; otherwise the
+ * value as-is when it isn't an envelope. This is what avoids double-wrapping the envelope as JSON
+ * inside wrapProtocolResult (the curated-direct path passes the envelope through transparently
+ * instead; the lean path goes through protocol.runTool -> wrapProtocolResult, so it unwraps here).
+ * NOTE: an upstream isError:true is surfaced as its text content with ok:true (homogeneous
+ * with how local tools surface error text) - mapping isError -> ok:false is a later concern.
+ * @param {*} envelope
+ * @returns {*}
+ */
+function unwrapEnvelope(envelope) {
+  if (!envelope || typeof envelope !== 'object') return envelope;
+  const content = envelope.content;
+  if (Array.isArray(content)) {
+    if (content.length === 1 && content[0] && content[0].type === 'text' && typeof content[0].text === 'string') {
+      return content[0].text;
+    }
+    return content;
+  }
+  return envelope;
+}
+
+/** Plain-JSON deep clone (schemas are JSON; structuredClone may be absent on old node). */
+function cloneJson(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+/** The upstream tool-def metadata the funnel FORWARDS onto advertised defs.
+ *  ICONS ARE WITHHELD by policy: 2025-11-25 and 2026-07-28 both require icon consumers to
+ *  verify icon URIs are SAME-ORIGIN with the server, so gateway-forwarded icons are third-party
+ *  URLs a conforming client must reject - or worse, trust as ours. Reversible (adding a field
+ *  later is non-breaking); the decision is open - forwarding them later flips it here. */
+const FORWARDED_TOOL_META = Object.freeze(['title', 'annotations', 'outputSchema', '_meta', 'execution']);
+
+/** Selectively copy the forwardable metadata from a RAW discovered def onto an advertised def.
+ *  NEVER a spread: lean defs carry internal routing ids (upstream/tool), and a spread would
+ *  also inherit unknown future fields sight-unseen (the explicit selective-add rule). Mutates + returns def. */
+function withForwardedToolMeta(def, raw) {
+  if (!raw || typeof raw !== 'object') return def;
+  for (const k of FORWARDED_TOOL_META) {
+    if (raw[k] !== undefined && def[k] === undefined) def[k] = cloneJson(raw[k]);
+  }
+  return def;
+}
+
+/** HTTP field-name token syntax (RFC 9110 §5.1) - the constraint on x-mcp-header values. */
+const XMCP_TCHAR = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+
+/**
+ * Strip INVALID `x-mcp-header` annotations from an advertised inputSchema, in place (ingest
+ * hygiene). The spec makes a single malformed annotation invalidate the WHOLE tool -
+ * conforming Streamable-HTTP clients MUST drop it from tools/list - so forwarding a broken
+ * upstream annotation verbatim makes the tool vanish client-side. Valid = on a pure
+ * `properties` chain from the root, a non-empty tchar token, on a string/integer/boolean
+ * param, case-insensitively unique among the valid set. Everything else is deleted (the TOOL
+ * survives; the annotation was the contaminant). The WRAP path stays raw-verbatim - a wrapped
+ * server's brokenness is presented faithfully, exactly as a direct connection would.
+ * @param {object} schema  the advertised (already-cloned) inputSchema - mutated
+ * @returns {object} schema
+ */
+function sanitiseXMcpHeaders(schema) {
+  if (!schema || typeof schema !== 'object') return schema;
+  const valid = [];  // { node, name } - candidates that pass every per-node rule
+  const strip = [];  // nodes whose annotation is deleted
+  (function walk(node, onChain) {
+    if (!node || typeof node !== 'object' || Array.isArray(node)) return;
+    if (Object.prototype.hasOwnProperty.call(node, 'x-mcp-header')) {
+      const v = node['x-mcp-header'];
+      const okType = node.type === 'string' || node.type === 'integer' || node.type === 'boolean';
+      if (onChain && typeof v === 'string' && XMCP_TCHAR.test(v) && okType) valid.push({ node, name: v.toLowerCase() });
+      else strip.push(node);
+    }
+    for (const k of Object.keys(node)) {
+      const child = node[k];
+      if (!child || typeof child !== 'object') continue;
+      if (k === 'properties' && !Array.isArray(child)) {
+        for (const sub of Object.values(child)) walk(sub, onChain); // the chain continues
+      } else if (Array.isArray(child)) {
+        for (const el of child) walk(el, false); // items/oneOf/... break the chain
+      } else {
+        walk(child, false);
+      }
+    }
+  })(schema, true);
+  const seen = new Map();
+  for (const e of valid) seen.set(e.name, (seen.get(e.name) || 0) + 1);
+  for (const e of valid) if (seen.get(e.name) > 1) strip.push(e.node); // ambiguous duplicates: all go
+  for (const n of strip) delete n['x-mcp-header'];
+  return schema;
+}
+
+/** Clone an array of tool defs so callers can't mutate the aggregator's cache. */
+function cloneTools(tools) {
+  return Array.isArray(tools) ? tools.map((t) => cloneJson(t)) : [];
+}
+
+module.exports = {
+  Aggregator,
+  // exported for unit tests / reuse
+  defaultClientFactory,
+  // The documented permanent-failure ceiling and its classifier.
+  PERMANENT_RETRY_LIMIT,
+  PERMANENT_ERROR_CODES,
+  isPermanentConnectError,
+  // Structural tool schema validation (drop one tool, never the upstream).
+  toolSchemaProblem,
+  MAX_SCHEMA_DEPTH,
+  looksLikePath,
+  isInside,
+  unwrapEnvelope,
+  DEFAULT_ROOT,
+  // 3.7: the forwardable def metadata + the selective-add - server.js's hot-promotion
+  // projection uses the same list so the two advertised paths can never drift apart again.
+  FORWARDED_TOOL_META,
+  withForwardedToolMeta,
+  // 4.3: ingest hygiene for x-mcp-header annotations (exported for tests).
+  sanitiseXMcpHeaders,
+  // A3: the wrap-time SECURITY NOTICE (bin/toolfunnel.js) enumerates the same classes the guard
+  // judges - shared lists, so the two surfaces can never classify differently.
+  isDriveRelative,
+  CODE_OPT_ENV,
+  CODE_PATH_ENV,
+};