toolroll 0.9.43 → 0.9.44

package/dist/mcp-person.js

@@ -0,0 +1,96 @@
+/**
+ * A person's tools on the HTTP gateway. A person signs in with their own API token (api-tokens.ts) and every tool call
+ * is the exact `toolroll` command line they could type, run on the server under their principal through
+ * `runOperateAs` with source "mcp": the command's own authorization, project grants and attribution apply, and its
+ * `--json` envelope is the answer. Nothing here reads data directly — a coordinator handler would skip the person's
+ * project grants — and nothing here approves, answers or changes people or policy: those verbs have no tool.
+ *
+ * tools/list follows the account's role and the token's scope; dispatch checks again, independent of the list.
+ */
+import { parseContract, toModelSchema } from "./contracts/contract.js";
+import { PERSON_TOOL_INPUTS, PERSON_TOOL_OUTPUTS } from "./contracts/gateway-tools.js";
+import { reportToolOutput } from "./contracts/lead-tools.js";
+import { callArguments } from "./mcp-core.js";
+const TOOLS = {
+    status: {
+        description: "Running work, queued reasons, results to review and plan windows, over the projects you may see.",
+        acts: false,
+        argv: () => ["status"],
+    },
+    list_tasks: {
+        description: "A page of tasks in the projects you may see. Filter by state and repo; cursor-paginated.",
+        acts: false,
+        argv: args => [
+            "task", "list",
+            ...(args.state === undefined ? [] : ["--state", args.state]),
+            ...(args.repo === undefined ? [] : ["--repo", args.repo]),
+            ...(args.cursor === undefined ? [] : ["--cursor", String(args.cursor)]),
+            ...(args.limit === undefined ? [] : ["--limit", String(args.limit)]),
+        ],
+    },
+    task_show: {
+        description: "One task in full. A task outside your projects answers unknown-task.",
+        acts: false,
+        argv: args => ["task", "show", args.ref],
+    },
+    task_review: {
+        description: "A task's compact result packet: saved conclusion, changed files, checks, findings, screenshots, plan and next actions. Pass run for an exact finished attempt; all includes LOW findings.",
+        acts: false,
+        argv: args => ["task", "review", args.ref, "--brief", ...(args.run === undefined ? [] : ["--run", String(args.run)]), ...(args.all === true ? ["--all"] : [])],
+    },
+    review_findings: {
+        description: "One run's automatic review findings.",
+        acts: false,
+        argv: args => ["task", "review", String(args.run)],
+    },
+    file_task: {
+        description: "File a task into one of your projects, under your name. It waits for approval as usual; approving stays in the console or chat. Replaying the same idempotency_key returns the first answer.",
+        acts: true,
+        argv: args => ["task", "add", args.title, "--repo", args.repo, "--key", args.idempotency_key, ...(args.deliverable === "report" ? ["--report"] : [])],
+    },
+};
+const NAMES = Object.keys(PERSON_TOOL_INPUTS);
+/** What this person may call: every read, and the acts only on an act token of an account that acts. */
+export function personTools(person) {
+    return NAMES.filter(name => mayCall(person, name)).map(name => ({ name, description: TOOLS[name].description, inputSchema: toModelSchema(PERSON_TOOL_INPUTS[name]) }));
+}
+const mayCall = (person, name) => !TOOLS[name].acts || person.principal.scope === "act" && person.role === "approver";
+/** One person tools/call: read by its schema, checked against the person, then run as the command it names. */
+export async function callPersonTool(person, store, runAs, params) {
+    const name = typeof params["name"] === "string" ? params["name"] : "";
+    if (!NAMES.includes(name))
+        return { kind: "error", code: -32602, message: `no tool \`${name}\``, fatal: false };
+    const tool = name;
+    const rawArgs = callArguments(params);
+    if (rawArgs === null)
+        return { kind: "error", code: -32602, message: "arguments must be an object", fatal: false };
+    const read = parseContract(PERSON_TOOL_INPUTS[tool], rawArgs);
+    if (!read.ok)
+        return { kind: "error", code: -32602, message: read.issues.map(one => one.line).join("; "), fatal: false };
+    if (!mayCall(person, tool)) {
+        const why = person.principal.scope === "read" ? "this token reads only — make an act token in the console to file work" : "your account can watch, not act";
+        return refused(`${tool}: ${why}`);
+    }
+    const argv = [...TOOLS[tool].argv(read.value), "--json"];
+    let written = "";
+    let code;
+    try {
+        code = await runAs(argv, { principal: person.principal, store, write: chunk => { written += chunk; }, source: "mcp" });
+    }
+    catch (error) {
+        return refused(`the command failed on the server: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const text = written.trim();
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return refused(text === "" ? `the command answered nothing (exit ${code})` : text);
+    }
+    const ok = code === 0 && typeof body === "object" && body !== null && body["ok"] === true;
+    if (ok)
+        reportToolOutput("gateway", tool, PERSON_TOOL_OUTPUTS[tool], body);
+    return { kind: "result", result: ok ? { content: [{ type: "text", text }] } : { content: [{ type: "text", text }], isError: true } };
+}
+const refused = (message) => ({ kind: "result", result: { content: [{ type: "text", text: message }], isError: true } });

package/dist/mcp.d.ts

@@ -1,12 +1,5 @@
 import type { Store } from "./store.js";
-export declare const MODERN = "2026-07-28";
-export declare const LEGACY = "2025-11-25";
-/** The modern revision namespaces its per-request metadata. */
-export declare const META_VERSION = "io.modelcontextprotocol/protocolVersion";
-export declare const META_SERVER = "io.modelcontextprotocol/serverInfo";
-export declare const META_CAPABILITIES = "io.modelcontextprotocol/clientCapabilities";
-/** The revision's own error code for an unsupported protocol version. */
-export declare const UNSUPPORTED_VERSION = -32022;
+export { LEGACY, META_CAPABILITIES, META_SERVER, META_VERSION, MODERN, UNSUPPORTED_VERSION } from "./mcp-core.js";
 export type McpIo = {
     onLine: (handler: (line: string) => void) => void;
     onEof: (handler: () => void) => void;

package/dist/mcp.js

@@ -1,12 +1,9 @@
-import { dirname, join } from 'node:path';
 import { statSync } from 'node:fs';
-import { repositoryContextRead } from './repository-context.js';
-import { ASSIGNMENT_TOOLS, assignmentForCoordinator } from "./assignment-adapters.js";
-import { parseContract, toModelSchema } from "./contracts/contract.js";
-import { GATEWAY_TOOL_INPUTS, GATEWAY_TOOL_OUTPUTS } from "./contracts/gateway-tools.js";
-import { reportToolOutput } from "./contracts/lead-tools.js";
 /**
- * `toolroll mcp` — the MCP stdio server (MCP gateway spec v6).
+ * `toolroll mcp` — the MCP stdio adapter (MCP gateway spec v6). What a
+ * call means lives in the transport-free core (mcp-core.ts); this file owns
+ * the stdio transport, era pinning and the connection's lifecycle.
+ *
  *
  * Zero-dep JSON-RPC 2.0 over stdio, newline-delimited; stdout carries
  * protocol bytes ONLY (logs go to stderr); clean EOF is clean shutdown.
@@ -31,207 +28,9 @@ import { reportToolOutput } from "./contracts/lead-tools.js";
  * refusals are successful `tools/call` results with `isError: true`.
  */
 import { PACKAGE_VERSION } from "./version.js";
-import { authenticateCoordinator, fileCoordinatorProposal, statusFor, listTasksFor, taskDetailFor, } from "./coordinator.js";
-import { ISO_STAMP_RULE, decisionOver, decisionsOver, labelRepos, queueOver, recapOver } from "./mate-tools.js";
-import { proposeAsCoordinator } from "./coordinator-proposals.js";
-export const MODERN = "2026-07-28";
-export const LEGACY = "2025-11-25";
-/** The modern revision namespaces its per-request metadata. */
-export const META_VERSION = "io.modelcontextprotocol/protocolVersion";
-export const META_SERVER = "io.modelcontextprotocol/serverInfo";
-export const META_CAPABILITIES = "io.modelcontextprotocol/clientCapabilities";
-/** The revision's own error code for an unsupported protocol version. */
-export const UNSUPPORTED_VERSION = -32022;
-const MAX_REQUEST = 256 * 1024;
-const MAX_DEPTH = 32;
-function depthOf(value) {
-    // The byte cap bounds the work list. Neither nesting nor array width
-    // becomes a JavaScript call stack or a spread argument list.
-    const pending = [{ value, depth: 0 }];
-    let maximum = 0;
-    while (pending.length > 0) {
-        const current = pending.pop();
-        if (current.depth > MAX_DEPTH)
-            return current.depth;
-        maximum = Math.max(maximum, current.depth);
-        if (current.value !== null && typeof current.value === "object") {
-            const children = Array.isArray(current.value) ? current.value : Object.values(current.value);
-            for (const child of children)
-                pending.push({ value: child, depth: current.depth + 1 });
-        }
-    }
-    return maximum;
-}
-const CONTRACT_GUIDE = [
-    "Toolroll MCP contract.",
-    "You hold a coordinator credential: you may read inside your repo allowlist, file proposals, and record assignment ownership and receipt checks. Ownership and receipt checks grant no execution or approval authority.",
-    "A filed proposal is an ordinary unapproved task: it is quarantined from planning, claiming, and running until the operator signs its scope in a password ceremony that shows them who asked. Modes never auto-admit coordinator filings.",
-    "file_proposal requires an idempotency_key (8-64 printable chars, unique per request): replaying the same key+request returns the original task; the same key with a different request refuses. deliverable 'report' files a scout task: a read-only investigation whose only output is a report on the task page, never a branch.",
-    "You are rate-limited per hour and capped on outstanding unapproved filings. Refusals say the limit and the road in words.",
-    "recap, list_decisions, get_decision, and queue are the plane's own read queries (shared with the operator's mate). get_decision shows each option's consequence, never the builder's recommendation.",
-    "propose_next, propose_reserve, propose_hold, propose_unhold, propose_scope, propose_cancel, and propose_answer write a PROPOSAL row and nothing else: an approver confirms it on the console or the CLI, and a stale one refuses there. Proposals share your hourly filing rate and hold at most 20 pending per credential; they expire after seven days.",
-    "Approve, steer, answer, pick, mint, configure, merge: those verbs do not exist on this surface, by construction.",
-    "Claim one assignment, then follow list_assignment_updates with a saved cursor; inspect get_assignment when a current result or decision needs attention. claim_assignment records its lead; acknowledge_assignment records that lead's check of an exact ready receipt. Neither operation grants authority, accepts proof, answers decisions, approves work, publishes, or deploys.",
-].join("\n");
-/** An assignment tool: the adapter reads its call with the same schema `toolroll assignment` does. */
-const assignmentHandler = (operation) => (ctx, args) => {
-    const result = assignmentForCoordinator(ctx.store, ctx.token, operation, args, ctx.now, ctx.evidenceRoot);
-    return result.ok ? { ok: true, body: result.body } : { ok: false, message: `${result.reason}: ${result.message}` };
-};
-const assignmentTool = (name) => {
-    const spec = ASSIGNMENT_TOOLS.find(one => one.name === name);
-    return { description: spec.description, handle: assignmentHandler(spec.operation) };
-};
-/** A propose_* tool: it writes one proposal row through the coordinator door. */
-const proposeTool = (kind, description) => ({
-    description,
-    handle: (ctx, args) => {
-        const outcome = proposeAsCoordinator(ctx.store, ctx.token, kind, args, ctx.now, { readDecisions: ctx.readDecisions });
-        if (!outcome.ok)
-            return { ok: false, message: outcome.message };
-        return { ok: true, body: { proposal: outcome.id, kind: outcome.kind, awaiting: outcome.awaiting } };
-    },
-});
-const HANDLERS = {
-    get_project_context: {
-        description: 'Read bounded source excerpts or advisory static import impact in an admitted project. Falls back to text search without an index.',
-        handle: (ctx, args) => {
-            const repo = args.repo;
-            if (!ctx.who.repos.includes(repo) || ctx.enrolled !== null && !ctx.enrolled.includes(repo))
-                return { ok: false, message: 'That project is outside your access.' };
-            return { ok: true, body: repositoryContextRead({ repo, query: args.query, mode: args.mode === 'impact' ? 'impact' : 'search', audience: 'lead',
-                    ...(ctx.evidenceRoot === undefined ? {} : { cacheRoot: join(dirname(ctx.evidenceRoot), 'repository-context') }) }) };
-        },
-    },
-    get_assignment: assignmentTool("get_assignment"),
-    list_assignment_updates: assignmentTool("list_assignment_updates"),
-    claim_assignment: assignmentTool("claim_assignment"),
-    acknowledge_assignment: assignmentTool("acknowledge_assignment"),
-    get_assignment_brief: assignmentTool("get_assignment_brief"),
-    get_assignment_inbox: assignmentTool("get_assignment_inbox"),
-    acknowledge_assignment_delivery: assignmentTool("acknowledge_assignment_delivery"),
-    status: {
-        description: "The plane's liveness facts over your repo allowlist: what waits on the operator, what runs, what finished in the last 24h.",
-        handle: ctx => ({ ok: true, body: statusFor(ctx.store, ctx.who, ctx.now) }),
-    },
-    list_tasks: {
-        description: "Tasks in your repo allowlist. Filter by state and repo; cursor-paginated, stable order.",
-        handle: (ctx, args) => {
-            const filter = {};
-            if (args.state !== undefined)
-                filter.state = args.state;
-            if (args.repo !== undefined)
-                filter.repo = args.repo;
-            if (args.cursor !== undefined)
-                filter.cursor = args.cursor;
-            if (args.limit !== undefined)
-                filter.limit = args.limit;
-            return { ok: true, body: listTasksFor(ctx.store, ctx.who, filter, ctx.now) };
-        },
-    },
-    get_task: {
-        description: "One task's deliverable (branch or report), scope standing, filer provenance, attempt ledger, and — for a finished scout — the report's title, summary, and follow-ups. A ref outside your allowlist answers not-found.",
-        handle: (ctx, args) => {
-            const detail = taskDetailFor(ctx.store, ctx.who, args.ref, ctx.evidenceRoot, ctx.now);
-            if (detail === null)
-                return { ok: false, message: `not-found: no task \`${args.ref}\` in your repositories` };
-            return { ok: true, body: detail };
-        },
-    },
-    list_repos: {
-        description: "The repositories your credential may see and file into, with their operating-mode standing.",
-        handle: ctx => {
-            // FAIL CLOSED when the project registry cannot be read (round-2
-            // finding 4): answering the full allowlist would claim enrollment
-            // nobody proved.
-            if (ctx.enrolled === null) {
-                return { ok: false, message: "the project registry could not be read — the enrolled set is unknown, so nothing lists" };
-            }
-            return {
-                ok: true,
-                body: {
-                    repos: ctx.who.repos
-                        .filter(repo => ctx.enrolled !== null && ctx.enrolled.includes(repo))
-                        .map(repo => {
-                        const mode = ctx.store.activeMode(repo, ctx.now);
-                        return { repo, mode: mode === null ? "no operating mode — every act is a ceremony" : `mode ${mode.name} signed until ${mode.absoluteExpiry}` };
-                    }),
-                },
-            };
-        },
-    },
-    recap: {
-        description: "How things stand per repository in your allowlist, counts and ids: what waits on the operator (decisions, incidents, scopes awaiting approval), what runs, what is queued, finished, failed. Pass `since` (an ISO timestamp) to count only decisions, incidents, and attempts newer than it, to the hour; queued work and scopes awaiting approval always count.",
-        handle: (ctx, args) => {
-            const since = args.since;
-            if (since !== undefined && (!ISO_STAMP_RULE.test(since) || Number.isNaN(Date.parse(since)))) {
-                return { ok: false, message: "since is an ISO timestamp like 2026-09-02T12:00:00Z" };
-            }
-            return { ok: true, body: labelRepos(recapOver(ctx.store, ctx.who.repos, ctx.now, since ?? null), index => ctx.who.repos[index] ?? "") };
-        },
-    },
-    list_decisions: {
-        description: "Open decisions in your allowlist: id, task, question, options (id, label, reversible), age in hours. Never consequences or recommendations; the operator answers them.",
-        handle: ctx => ({ ok: true, body: labelRepos(decisionsOver(ctx.store, ctx.who.repos, ctx.now), index => ctx.who.repos[index] ?? "") }),
-    },
-    queue: {
-        description: "One repository's queue by column — the shared column, then each worker's reserved column — each in dispatch order.",
-        handle: (ctx, args) => {
-            const repo = args.repo;
-            if (!ctx.who.repos.includes(repo))
-                return { ok: false, message: "not-found: that repository is not in your allowlist" };
-            // The installation-wide revision stays home (slice-2 review, finding
-            // 12): a coordinator cannot move queues, and the counter would tell it
-            // about repos it may not see.
-            const { queueRevision: _revision, ...columns } = queueOver(ctx.store, repo, ctx.now);
-            return { ok: true, body: { repo, ...columns } };
-        },
-    },
-    get_decision: {
-        description: "One open decision in your allowlist in full: question, options with id, label, reversible, and consequence. Never the builder's recommendation.",
-        handle: (ctx, args) => {
-            const found = decisionOver(ctx.store, ctx.who.repos, args.decision, ctx.now);
-            if (found === null)
-                return { ok: false, message: "not-found: no such decision in your repositories" };
-            ctx.readDecisions.add(args.decision);
-            return { ok: true, body: labelRepos(found, index => ctx.who.repos[index] ?? "") };
-        },
-    },
-    propose_next: proposeTool("next", "Propose moving a queued task to the front of its column. An approver confirms; a queue that moved meanwhile refuses."),
-    propose_reserve: proposeTool("reserve", "Propose reserving a queued task for one worker, or releasing it to the shared queue with worker null."),
-    propose_hold: proposeTool("hold", "Propose holding a task's next attempt, with a reason. A running attempt is never interrupted."),
-    propose_unhold: proposeTool("unhold", "Propose lifting the operator's own hold on a task."),
-    propose_scope: proposeTool("scope", "Propose rewriting a task's scope. An approver confirms the rewrite, then approves it with a password — a scope you wrote never seals under a mode."),
-    propose_cancel: proposeTool("cancel", "Propose cancelling a task, with a reason. The approver arms and confirms it on the task itself."),
-    propose_answer: proposeTool("answer", "Propose an answer to an open decision you read with get_decision, with a rationale. The approver confirms where every consequence and the builder's recommendation are shown; an irreversible option needs their explicit confirmation."),
-    get_contract: {
-        description: "This surface's contract: what a coordinator may do, the proposal lifecycle, and the admission promise.",
-        handle: () => ({ ok: true, body: { contract: CONTRACT_GUIDE } }),
-    },
-    file_proposal: {
-        description: "File a task proposal into one of your repositories. It stays quarantined until the operator signs its scope.",
-        handle: (ctx, args) => {
-            // The token, not the pre-verified identity: filing re-authenticates
-            // INSIDE its own transaction (the session's `who` is a courtesy).
-            const outcome = fileCoordinatorProposal(ctx.store, ctx.token, { repo: args.repo, title: args.title, ...(args.intent === undefined ? {} : { intent: args.intent }), ...(args.deliverable === undefined ? {} : { deliverable: args.deliverable }), idempotencyKey: args.idempotency_key }, ctx.now);
-            if (!outcome.ok)
-                return { ok: false, message: outcome.message };
-            return {
-                ok: true,
-                body: {
-                    ref: outcome.id,
-                    replayed: outcome.replayed,
-                    admission: "quarantined until the operator signs its scope — the ceremony shows them your name",
-                },
-            };
-        },
-    },
-};
-/** The gateway's tools in tools/list order, each inputSchema derived from its contract. */
-const TOOLS = Object.keys(GATEWAY_TOOL_INPUTS).map((name) => {
-    const handler = HANDLERS[name];
-    return { name, description: handler.description, inputSchema: toModelSchema(GATEWAY_TOOL_INPUTS[name]), handle: (ctx, args) => handler.handle(ctx, args) };
-});
+import { authenticateCoordinator } from "./coordinator.js";
+import { LEGACY, META_CAPABILITIES, META_SERVER, META_VERSION, MODERN, TOOLS, UNSUPPORTED_VERSION, callCoordinatorTool, capabilitiesShape, readMessage, shapeResult, toolsPayload, } from "./mcp-core.js";
+export { LEGACY, META_CAPABILITIES, META_SERVER, META_VERSION, MODERN, UNSUPPORTED_VERSION } from "./mcp-core.js";
 function fileIdentity(path) {
     if (path === null)
         return null;
@@ -286,16 +85,8 @@ export function serveMcp(store, token, io, clock = () => new Date(), enrolled =
     const respond = (id, era, result, cacheable) => {
         if (id !== null && cancelled.has(JSON.stringify(id)))
             return; // suppressed entirely
-        const complete = era === "modern"
-            ? { ...result, resultType: "complete", ...(cacheable ? { ttlMs: 0, cacheScope: "private" } : {}) }
-            : result;
-        io.write(JSON.stringify({ jsonrpc: "2.0", id, result: complete }));
+        io.write(JSON.stringify({ jsonrpc: "2.0", id, result: shapeResult(era, result, cacheable) }));
     };
-    const toolsPayload = () => ({
-        // No outputSchema: MCP output schemas describe structuredContent, and
-        // these tools return text content only (round-2 finding 1).
-        tools: TOOLS.map(tool => ({ name: tool.name, description: tool.description, inputSchema: tool.inputSchema })),
-    });
     const callTool = (id, era, params) => {
         // A restore or rollback puts a different file at the database's path: this server's connection still reads and
         // writes the one it replaced, so it answers nothing more and exits (the agent starts it again on the new one).
@@ -304,112 +95,23 @@ export function serveMcp(store, token, io, clock = () => new Date(), enrolled =
             io.exit(0);
             return;
         }
-        // ONE snapshot per call (review finding 3): the version check, the
-        // credential re-read, and every data read share a transaction, so a
-        // concurrent migration cannot slip between them; filing's own
-        // BEGIN IMMEDIATE reenters this one. A moved schema refuses in words
-        // and the server exits clean.
-        store.transact(() => {
-            if (!store.schemaCurrent()) {
-                error(id, -32000, "the database schema moved underneath this server — restart it");
-                io.exit(0);
-                return;
-            }
-            const name = typeof params["name"] === "string" ? params["name"] : "";
-            const tool = TOOLS.find(one => one.name === name);
-            if (tool === undefined) {
-                error(id, -32602, `no tool \`${name}\``);
-                return;
-            }
-            // tools/list visibility is presentation — authorization happens HERE,
-            // on every call, against the live credential row.
-            const session = authenticateCoordinator(store, token);
-            if (!session.ok) {
-                error(id, -32000, "this credential no longer stands — the server exits");
-                io.exit(0);
-                return;
-            }
-            // Only an ABSENT `arguments` defaults to empty (round-3 finding 2): an
-            // explicit null is not the optional-object shape MCP defines.
-            const rawArgs = params["arguments"] === undefined ? {} : params["arguments"];
-            if (typeof rawArgs !== "object" || rawArgs === null || Array.isArray(rawArgs)) {
-                // The root of `arguments` is an object BEFORE any schema applies
-                // (round-2 finding 2): 42 or false never passes an empty schema.
-                error(id, -32602, "arguments must be an object");
-                return;
-            }
-            // The call is read by the schema tools/list advertised (review finding
-            // 2): unknown fields, bad types, bad enums, and bound violations are
-            // protocol errors (InvalidParams) naming each path, never tool refusals.
-            const read = parseContract(GATEWAY_TOOL_INPUTS[tool.name], rawArgs);
-            if (!read.ok) {
-                error(id, -32602, read.issues.map(one => one.line).join("; "));
-                return;
-            }
-            const answered = tool.handle({ store, who: session.who, token, enrolled, now: clock(), readDecisions, ...(evidenceRoot === undefined ? {} : { evidenceRoot }) }, read.value);
-            if (!answered.ok) {
-                respond(id, era, { content: [{ type: "text", text: answered.message }], isError: true }, false);
-                return;
-            }
-            // Checked against its output schema before delivery; a disagreement is reported, never refused.
-            reportToolOutput("gateway", tool.name, GATEWAY_TOOL_OUTPUTS[tool.name], answered.body);
-            respond(id, era, { content: [{ type: "text", text: JSON.stringify(answered.body) }] }, false);
-        });
+        // A moved schema or a credential that no longer stands refuses in words and the server exits clean.
+        const outcome = callCoordinatorTool({ store, token, enrolled, clock, readDecisions, ...(evidenceRoot === undefined ? {} : { evidenceRoot }) }, params);
+        if (outcome.kind === "result")
+            return respond(id, era, outcome.result, false);
+        error(id, outcome.code, outcome.message);
+        if (outcome.fatal)
+            io.exit(0);
     };
     io.onLine(line => {
         if (line.trim() === "")
             return;
-        if (Buffer.byteLength(line, "utf8") > MAX_REQUEST) {
-            error(null, -32600, "request over 256 KiB");
-            return;
-        }
-        let message;
-        try {
-            message = JSON.parse(line);
-        }
-        catch {
-            error(null, -32700, "parse error");
-            return;
-        }
-        if (Array.isArray(message)) {
-            // Batching left MCP in 2025-06-18 — neither pinned era accepts it.
-            error(null, -32600, "JSON-RPC batching is not part of MCP — send one request per line");
-            return;
-        }
-        if (message === null || typeof message !== "object" || depthOf(message) > MAX_DEPTH) {
-            error(null, -32600, "invalid request");
-            return;
-        }
-        const request = message;
-        if (request["jsonrpc"] !== "2.0") {
-            error(null, -32600, 'jsonrpc must be "2.0"');
-            return;
-        }
-        // A notification is the message that carries NO id — the method name
-        // never decides (round-3 finding 3): notifications/initialized WITH an
-        // id is a malformed message, not a quiet notification. MCP RequestId is
-        // a string or an INTEGER (round-2 finding 2): floats, null, and object
-        // shapes refuse wherever an id appears.
-        const hasId = "id" in request;
-        const rawId = request["id"];
-        if (hasId && (rawId === null || (typeof rawId !== "string" && !(typeof rawId === "number" && Number.isInteger(rawId))))) {
-            error(null, -32600, "id must be a string or an integer");
-            return;
-        }
-        const method = typeof request["method"] === "string" ? request["method"] : "";
-        if (method.startsWith("notifications/")) {
-            if (hasId) {
-                error(rawId, -32600, "a notification carries no id");
-                return;
-            }
-        }
-        else if (!hasId) {
-            error(null, -32600, "a request carries an id — a string or an integer");
+        const read = readMessage(line);
+        if (!read.ok) {
+            error(read.id, read.code, read.message);
             return;
         }
-        const id = (rawId ?? null);
-        const params = (request["params"] ?? {});
-        const meta = (params["_meta"] ?? {});
+        const { id, method, params, meta } = read;
         // Every method — lifecycle included — refuses on a moved schema
         // (review finding 3): a server that answers discover from one world
         // and tools from another is lying to somebody.
@@ -453,9 +155,6 @@ export function serveMcp(store, token, io, clock = () => new Date(), enrolled =
             }));
             return;
         }
-        // ClientCapabilities is an OBJECT shape (round-3 finding 5): an array
-        // is not a capabilities declaration.
-        const capabilitiesShape = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
         if (method === "initialize") {
             if (pinnedEra === "modern") {
                 error(id, -32600, "this connection speaks the modern era — initialize belongs to the handshake era");
@@ -489,7 +188,7 @@ export function serveMcp(store, token, io, clock = () => new Date(), enrolled =
                 supportedVersions: [MODERN, LEGACY],
                 capabilities: { tools: {} },
                 _meta: { [META_SERVER]: { name: "toolroll", version: PACKAGE_VERSION } },
-                ...toolsPayload(),
+                ...toolsPayload(TOOLS),
             }, true);
             return;
         }
@@ -523,7 +222,7 @@ export function serveMcp(store, token, io, clock = () => new Date(), enrolled =
             return;
         }
         if (method === "tools/list") {
-            respond(id, era, toolsPayload(), true);
+            respond(id, era, toolsPayload(TOOLS), true);
             return;
         }
         if (method === "tools/call") {

package/dist/operate-remote-arguments.d.ts

@@ -0,0 +1,36 @@
+/** The audited remote argument vocabulary. Unlisted flags and extra positionals never dispatch.
+ * Keep scalar inputs explicit: adding a resource argument requires classifying it here first.
+ * Indices below are relative to the command row (after `task review`, `flows trigger add`, etc.). */
+import type { Store } from './store.js';
+type Kind = 'value' | 'task' | 'run' | 'review' | 'flow' | 'trigger' | 'trigger-json' | 'steps' | 'refused' | 'step-up';
+type Argument = {
+    name: string;
+    kind: Kind;
+    optional: boolean;
+    rest: boolean;
+};
+export type RemoteArguments = {
+    positionals: readonly Argument[];
+    flags: ReadonlyMap<string, Kind>;
+};
+/** All remotely allowed rows, including those with no resource references. Credentials and file-output
+ * flags are refused by the outer boundary. `source` on memory is provenance text; on revise it is a scope
+ * digest. Neither dereferences a conversation, task or proposal. Creation IDs are never looked up. */
+export declare const REMOTE_ARGUMENTS: ReadonlyMap<string, RemoteArguments>;
+export declare const REMOTE_NOT_FOUND: {
+    readonly ok: false;
+    readonly reason: 'not-found';
+    readonly message: 'Not found.';
+};
+type Result = {
+    ok: true;
+    repo: string | null;
+    taskId: string | null;
+} | {
+    ok: false;
+    reason: string;
+    message: string;
+};
+/** Read-only authorization of every supplied reference, before the handler can disclose or mutate it. */
+export declare function remoteArgumentsOf(store: Store, allows: (repo: string | null) => boolean, invocation: string, positional: readonly string[], flags: ReadonlyMap<string, string | true>, named: string | null, files: Readonly<Record<string, string>>): Result;
+export {};