tribunal-kit 5.8.5 → 6.0.0

package/.agent/workflows/tribunal-performance.md

@@ -1,6 +1,15 @@
 ---
 description: Performance-specific Tribunal. Runs Logic + Performance reviewers. Use when code is slow, for optimization tasks, bundle analysis, Core Web Vitals improvement, memory leak investigation, and before deploying performance-critical features.
-required-skills: performance-profiling
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - performance-profiling
+  - 60fps-animation
+  - gsap-performance
+scripts-binding:
+  - .agent/scripts/bundle_analyzer.js
+  - .agent/scripts/test_runner.js
 ---
 
 # /tribunal-performance — Performance Audit
@@ -9,14 +18,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE performance review:
-□ Target code files           → The code being optimized
-□ package.json                → Check for known heavy libraries (e.g. moment, lodash)
-□ Next.js / bundler config    → Check for bundle optimization settings
-```
+Before optimizing code or running performance reviews, you MUST inspect:
+1. Target Source & Heavy Import Inspection (`package.json`, `next.config.js`) → Identify heavy library imports (`moment`, full `lodash`) for tree-shaking
+2. Measured Baseline Metrics → Run `bundle_analyzer.js` or latency measurements; ban claiming performance improvements without measured proof
+3. 2-Reviewer Performance Gate → Run logic-reviewer and performance-optimizer before approving optimization diffs
 
 ---
 

package/.agent/workflows/tribunal-speed.md

@@ -1,6 +1,15 @@
 ---
 description: Full-stack parallel performance audit. Runs 3 scoped specialists simultaneously — vitals-reviewer (Frontend CWV), db-latency-auditor (SQL/ORM), throughput-optimizer (Node.js server) — then synthesizes a single ranked report. Maximum 5 AI calls regardless of project size. Use when full-stack performance profiling is needed.
-required-skills: performance-profiling, observability
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - performance-profiling
+  - observability
+  - edge-computing
+scripts-binding:
+  - .agent/scripts/bundle_analyzer.js
+  - .agent/scripts/verify_all.js
 ---
 
 # /tribunal-speed — Full-Stack Performance Swarm
@@ -9,14 +18,12 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE performance swarm:
-□ Target directory/files      → Determine frontend vs backend vs DB code
-□ package.json                → Identify the full stack architecture
-□ Database schemas            → Needed for the db-latency-auditor
-```
+Before running a full-stack performance audit, you MUST inspect:
+1. Target Full-Stack File Map → Determine frontend components, Node.js server routes, and database models
+2. Max 5 AI Call Ceiling → Cap swarm executions to 3 parallel specialists + 1 synthesis step to prevent token explosion
+3. Ranked Impact Synthesis → Output findings strictly in a single unified table prioritized by user-facing latency impact
 
 ---
 
@@ -181,7 +188,7 @@ If a specialist fails after 3 retries:
 | :------------------------- | :------------------------------- | :--------------------- | :--------------------------------------- |
 | `/tribunal-performance`    | logic + performance-reviewer     | Generic CWV check      | Quick single-file perf scan              |
 | `/tribunal-speed`          | vitals + db-latency + throughput | Deep 3-domain parallel | Full-stack perf audit                    |
-| `/tribunal-full`           | All 19 reviewers                 | Everything             | Maximum coverage (security + perf + all) |
+| `/tribunal-full`           | All 21 reviewers                 | Everything             | Maximum coverage (security + perf + all) |
 | `/performance-benchmarker` | Lighthouse + bundle              | Measurement only       | Get actual scores, not code review       |
 
 ---

package/.agent/workflows/tribunal-ui.md

@@ -0,0 +1,82 @@
+---
+description: Specialized UI/UX Tribunal. Runs UX + Visual + Interaction + Anti-Pattern + Product Heuristics + Accessibility + Visual Auditor reviewers. Use for all visual designs, component layouts, and design-system reviews.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - ui-reasoning-engine
+  - product-aware-heuristics
+  - ui-ux-pro-max
+  - frontend-design
+  - web-design-guidelines
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/verify_all.js
+---
+
+# /tribunal-ui — Dedicated UI/UX Review Pipeline
+
+$ARGUMENTS
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Before executing dedicated UI/UX audits or design-system reviews, you MUST inspect:
+1. Active Design Tokens & Guidelines (`DESIGN.md`, CSS custom properties) → Confirm typography scale, color system, and corner radius tokens
+2. Product Domain Category → Select category heuristics (Dashboard, E-Commerce, Landing Page, Mobile App, Marketing)
+3. 7-Reviewer Dedicated UI Gate → Run ux-auditor, visual-auditor, interaction-auditor, anti-pattern-auditor, product-heuristics, a11y-auditor, and visual-auditor before passing designs
+
+---
+
+## When to Use /tribunal-ui
+
+| Use `/tribunal-ui` when... | Use instead when... |
+| :--- | :--- |
+| Auditing visual hierarchy & rhythm | Reviewing backend routing → `/tribunal-backend` |
+| Verifying interactive states and hover/focus | Reviewing database transaction code → `/tribunal-database` |
+| Checking responsive behavior and ergonomics | Doing general logical code checks → `/tribunal-frontend` |
+| Banning generic AI templates & purple gradients | |
+| Testing accessibility compliance (WCAG 2.2 AA) | |
+
+---
+
+## 7 Specialized UI Reviewers (Running Simultaneously)
+
+### 1. ux-reviewer
+*   **Focus:** Hick's Law, Fitts's Law, cognitive load, scanning patterns, scannability, and progressive disclosure.
+*   **Check:** Are primary action targets separated from destructive ones? Is choice overload prevented?
+
+### 2. visual-reviewer
+*   **Focus:** Typographical scaling, alignment, margins, 8px grid discipline, and line lengths.
+*   **Check:** Do Display headings balanced-wrap (`text-wrap: balance`)? Is negative space utilized?
+
+### 3. interaction-reviewer
+*   **Focus:** Full interactive state styling (Default, Hover, Active/Pressed, Disabled, Focus-visible, Loading).
+*   **Check:** Is there scale-down active click feedback? Are focus outlines visible and offset?
+
+### 4. anti-pattern-reviewer
+*   **Focus:** Blocking generic AI visual clichés.
+*   **Check:** Blocks purple/violet primary colors, radial mesh gradients, bento grid overload, flat cards lacking depth, and card-in-card overlap.
+
+### 5. product-reviewer
+*   **Focus:** Matching the UI structure to product category heuristics (SaaS, DevTool, AI Interface, Landing, Fintech).
+*   **Check:** Tabular numbers used for financial data? Monospace code snippets for DevTools? Typing skeleton streams for AI?
+
+### 6. accessibility-reviewer
+*   **Focus:** WCAG 2.2 Level AA compliance.
+*   **Check:** Minimum target size 24px (standard AA) and 44px (touch). Semantic headings, accessible ARIA names, and keyboard trap focus in dialogs.
+
+### 7. ui-visual-auditor (Closed-Loop Visual Gate)
+*   **Focus:** Screenshot or DOM layout verification.
+*   **Check:** Checks vertical overflow, layout shifts (CLS), alignment shifts, and contrast ratios.
+
+---
+
+## Verdict System
+
+```
+If ANY reviewer → ❌ REJECTED: Maker must fix and resubmit before Human Gate
+If any reviewer → ⚠️ WARNING:  highlighted at Human Gate, must fix before deploy
+If all reviewers → ✅ APPROVED: Passes to Human Gate for writing approval
+```

package/.agent/workflows/ui-ux-pro-max.md

@@ -1,6 +1,17 @@
 ---
-description: Plan and implement cutting-edge advanced UI/UX. Creates distinctive, production-grade frontend interfaces with high design quality that avoid generic AI aesthetics. Now uses a modular swarm architecture to decompose layout, styling, and motion tasks.
-required-skills: ui-ux-researcher, frontend-design, emil-design-eng, motion-engineering, agent-organizer, parallel-agents
+description: Plan and implement cutting-edge advanced UI/UX. Uses the UI Reasoning Engine to structure layout and styling, and routes through the dedicated `/tribunal-ui` reviewer pipeline.
+tools: Read, Grep, Glob, Bash, Edit, Write
+version: 3.0.0
+last-updated: 2026-07-30
+required-skills:
+  - ui-reasoning-engine
+  - product-aware-heuristics
+  - ui-ux-pro-max
+  - frontend-design
+  - web-design-guidelines
+scripts-binding:
+  - .agent/scripts/lint_runner.js
+  - .agent/scripts/auto_preview.js
 ---
 
 # /ui-ux-pro-max — Advanced UI/UX Design
@@ -9,126 +20,62 @@ $ARGUMENTS
 
 ---
 
-## $CONTEXT_REQUIRED
+## Mandatory Pre-Flight Context Inspection
 
-```
-Read BEFORE designing:
-□ Current UI components       → Follow project idioms and design systems
-□ .agent/skills/frontend-design/SKILL.md → Refresh UI guidelines
-```
+Before designing or implementing advanced UI/UX layouts, you MUST inspect:
+1. Active Design Tokens & System (`DESIGN.md`, CSS custom properties) → Verify OKLCH color palettes, typography scale, and spacing grid
+2. UI Reasoning Engine 16-Step Pipeline (`.agent/skills/ui-reasoning-engine/SKILL.md`) → Structure component layout, micro-interactions, and accessibility before coding
+3. Anti-Generic Aesthetic Rule → Ban plain purple/violet AI gradients and stock hero templates; enforce bespoke visual hierarchy and tactile micro-interactions
 
 ---
 
 ## When to Use /ui-ux-pro-max
 
-| Use `/ui-ux-pro-max` when...              | Use instead when...                     |
-| :---------------------------------------- | :-------------------------------------- |
+| Use `/ui-ux-pro-max` when... | Use instead when... |
+| :--- | :--- |
 | Building a visually distinctive interface | Functional-only component → `/generate` |
-| Design quality is the primary goal        | Fast page needed → `/enhance`           |
-| Creating from a design brief              | Bug fix in UI → `/debug`                |
-| Mobile + web parity required              |                                         |
+| Design quality is the primary goal | Fast page needed → `/enhance` |
+| Creating from a design brief | Bug fix in UI → `/debug` |
+| Mobile + web parity required | |
 
 ---
 
-## Phase 1 — Design Intent (Mandatory)
+## Phase 1 — Design Intent & Product Aware Reasoning (Mandatory)
 
-Answer these before any design work:
+Answer these before writing any code (using the `ui-reasoning-engine` skill):
+1. **Who is the user?** (Casual consumer vs expert operator).
+2. **What is the product category?** (SaaS, DevTool, AI Interface, Landing, Fintech).
+3. **What is the visual direction?** (Brutalist, Editorial, Soft Minimal, Dark Luxury, Swiss).
+4. **What is the primary user goal?** (Optimize the layout and click paths for this action).
+5. **What are the accessibility requirements?** (Focus paths, target size, Lc contrast).
 
-```
-1. Who is the user? (developer tools feel different from consumer apps)
-2. What emotion should the interface evoke? (calm focus, urgent speed, playful delight)
-3. What is the ONE thing users do most? (hero interaction gets maximum design attention)
-4. What existing interfaces does the user love? (don't copy — understand the WHY)
-5. What makes this interface DIFFERENT from every competitor?
-```
+Write the **🧠 UI Reasoning Engine Trace** in your response as a collapsed markdown block before the code.
 
 ---
 
-## Phase 2 — Design Identity
+## Phase 2 — Visual Identity & Design Tokens
 
-Every interface built by /ui-ux-pro-max has a distinct visual identity:
-
-```
-Forbidden defaults (generic AI aesthetics):
-❌ Purple/violet as primary color
-❌ Left text / right image hero section
-❌ Mesh gradient backgrounds
-❌ Bento grid as the only layout
-❌ Emoji as icons
-❌ shadcn without explicit user request
-
-Distinctive alternatives:
-✅ Signal orange, acid green, warm slate, deep red — intentional palettes
-✅ Typographic-first hero sections
-✅ Grain textures, solid contrast, radial depth
-✅ Asymmetric or broken-grid layouts
-✅ SVG icons (lucide-react or custom)
-✅ Motion that communicates meaning (not decoration)
-```
+Every interface must use custom variables defined in `DESIGN.md` and `design-tokens.json`:
+*   ❌ **Banned Clichés:** Purple/violet accents, mesh gradients, glassmorphism overuse, default library themes.
+*   ✅ **Intentional Styling:** Dynamic OKLCH colors, 8px grid alignment, variable font sizes with CSS `clamp()`, and 1px luminous borders.
 
 ---
 
-## Phase 3 — Interaction Craft
+## Phase 3 — Interaction States & Micro-interactions
 
-Every interactive element has 4 states designed:
-
-```
-1. Default:  The base state
-2. Hover:    Indicates interactability (cursor change, subtle lift, color shift)
-3. Active:   Confirms click/press (scale down, darker, haptic feedback on mobile)
-4. Disabled: Communicates unavailability (reduced opacity, cursor change, tooltip why)
-```
-
-Micro-animations are required, not optional:
-
-```
-Entry animations:  elements fade/slide in on mount
-State transitions: smooth color + scale changes (150–200ms)
-Loading states:    skeleton screens, not spinners (skeleton shows shape)
-Error shake:       invalid form input shakes (4px left-right)
-Success pulse:     confirmed actions pulse green briefly
-```
+Ensure every interactive element has styling defined for:
+*   `hover`, `focus-visible`, `active`/`pressed`, and `disabled` states.
+*   Confirm clicks with spring scale-down transitions (`active:scale-[0.97]`).
+*   Trap keyboard focus within modals/dialogs and return it to the trigger on close.
 
 ---
 
-## Phase 4 — Swarm Implementation (Modular Generation)
-
-Instead of a single agent generating the entire UI, `/ui-ux-pro-max` leverages a Fan-Out/Fan-In swarm architecture using `.agent/scripts/swarm_dispatcher.js`. The Supervisor decomposes the component into a structured JSON contract for three specialized workers:
+## Phase 4 — Swarm Implementation & UI Review Pipeline
 
-### Worker 1: Layout Architect (`frontend-specialist`)
-- **Focus**: Semantic HTML, accessibility tree, and component composition.
-- **Rules**: Zero styling, just the raw structure and React state logic.
-- **WCAG Checks**: Keyboard navigation, screen reader semantics (role, label).
-
-### Worker 2: Styling & Token Specialist (`frontend-design`)
-- **Focus**: Applies Tailwind classes and design tokens based on the Phase 2 Identity.
-- **Rules**: Must enforce color contrast (4.5:1 minimum) and spacing scale; strictly avoids generic AI defaults.
-
-### Worker 3: Motion Engineer (`motion-engineering` + `emil-design-eng`)
-- **Focus**: Injects GSAP, Framer Motion, or CSS springs for micro-interactions (Phase 3).
-- **Rules**: Enforces Emil Kowalski's non-negotiable UI standards: all UI animations <300ms, popovers are origin-aware, entering elements strictly use `ease-out`, and `prefers-reduced-motion` is honored.
-
-**Execution Flow**:
-1. Supervisor builds the JSON contract for the 3 workers.
-2. Dispatches workers in parallel via `swarm_dispatcher.js`.
-3. Fan-in synthesis merges the layout, styles, and motion into the final component file.
-4. Final code is routed through `/tribunal-frontend` (which now includes the `review-animations` strict UI constraint gate) for the Human Gate.
-
----
-
-## Phase 5 — Design Verification
-
-Before finalizing:
-
-```
-□ Open in mobile viewport (375px) — does it work?
-□ Open in dark mode — does it look intentional?
-□ Keyboard-navigate through the critical path — is it complete?
-□ Screenshot and ask: "Would I scroll past this on Dribbble?"
-□ Screen reader test with VoiceOver or NVDA
-```
-
----
+1. **Layout Design:** Create the structural grid and semantic accessibility tree.
+2. **Token Application:** Apply Tailwind classes or style blocks using variables.
+3. **Motion Integration:** Add GSAP or Framer Motion transitions (keeping motion <300ms, respecting reduced motion).
+4. **Tribunal Review Gate:** Route the generated component through `/tribunal-ui` for parallel verification.
 
 ---
 
@@ -138,18 +85,15 @@ Before finalizing:
 /ui-ux-pro-max design a SaaS dashboard for an analytics platform
 /ui-ux-pro-max redesign the checkout flow with better conversion UX
 /ui-ux-pro-max create an onboarding flow for a developer tool
-/ui-ux-pro-max design the landing page hero section with distinctive layout
-/ui-ux-pro-max create a data visualization dashboard with real-time updates
+/ui-ux-pro-max design the landing page hero section with a distinctive visual style
 ```
 
 ---
 
 ## After /ui-ux-pro-max — Next Steps
 
-| Outcome                   | Next Command                           |
-| :------------------------ | :------------------------------------- |
-| Design complete           | → `/preview start` to see it in action |
-| Need responsive checks    | → `/review` or manual viewport testing |
-| Needs backend integration | → `/tribunal-backend` to hook up APIs  |
-
----
+| Outcome | Next Command |
+| :--- | :--- |
+| Design complete | → `/preview start` to see it in action |
+| Reviewers reject with fixes | → Apply fixes, then run `/tribunal-ui` again |
+| Performance concerns | → `/performance-benchmarker` for Lighthouse/CWV |

package/CONTRIBUTING.md

@@ -42,9 +42,9 @@ tribunal-kit/
 │   └── index.d.ts          # TypeScript declarations
 ├── crates/core/            # Rust core engine (Tokio-based)
 ├── .agent/                 # The intelligence payload (agents, skills, workflows)
-│   ├── agents/             # 44 specialist and reviewer agent definitions
+│   ├── agents/             # 51 specialist and reviewer agent definitions
 │   ├── skills/             # Reusable skill packs
-│   ├── workflows/          # 34 workflow definitions
+│   ├── workflows/          # 37 workflow definitions
 │   └── scripts/            # Automation scripts
 ├── test/
 │   ├── unit/               # Unit tests (Jest)

package/README.md

@@ -20,7 +20,7 @@
       <img src="https://img.shields.io/badge/License-MIT-1a1a1f?style=for-the-badge&color=2d2d30" alt="License" />
     </a>
     <a href="CHANGELOG.md">
-      <img src="https://img.shields.io/badge/Release-v5.8.5-ccff00?style=for-the-badge&color=111111&logo=github&logoColor=ccff00" alt="Release Version" />
+      <img src="https://img.shields.io/badge/Release-v6.0.0-ccff00?style=for-the-badge&color=111111&logo=github&logoColor=ccff00" alt="Release Version" />
     </a>
     <a href="mcp_config.json">
       <img src="https://img.shields.io/badge/MCP-Ready-00c2ff?style=for-the-badge&logo=openai&logoColor=111" alt="MCP Server" />
@@ -40,7 +40,7 @@
     <strong style="color: #ffffff; font-size: 1.1em;">AI GENERATES CODE. TRIBUNAL KIT GOVERNS IT.</strong>
   </div>
   <p style="color: #c9c9d1; font-size: 0.95em; line-height: 1.6; margin: 0;">
-    A zero-bloat <strong>.agent/</strong> intelligence payload and <strong>Model Context Protocol (MCP) server</strong> that upgrades your IDEs (<a href="#" style="color: #ccff00; text-decoration: none;">Cursor</a>, <a href="#" style="color: #ccff00; text-decoration: none;">VSCode</a>, <a href="#" style="color: #ccff00; text-decoration: none;">Windsurf</a>) and terminal AI coding assistants (<a href="#" style="color: #ccff00; text-decoration: none;">Claude Code</a>, <a href="#" style="color: #ccff00; text-decoration: none;">Aider</a>) with <strong>44 specialist agents</strong>, <strong>34 workflows</strong>, and a parallel <strong>19-reviewer Tribunal pipeline</strong>. Establishes absolute runtime correctness, optimizes context windows, and heavily mitigates AI code hallucinations.
+    A zero-bloat <strong>.agent/</strong> intelligence payload and <strong>Model Context Protocol (MCP) server</strong> that upgrades your IDEs (<a href="#" style="color: #ccff00; text-decoration: none;">Cursor</a>, <a href="#" style="color: #ccff00; text-decoration: none;">VSCode</a>, <a href="#" style="color: #ccff00; text-decoration: none;">Windsurf</a>) and terminal AI coding assistants (<a href="#" style="color: #ccff00; text-decoration: none;">Claude Code</a>, <a href="#" style="color: #ccff00; text-decoration: none;">Aider</a>) with <strong>51 specialist agents</strong>, <strong>37 workflows</strong>, <strong>171 reusable skills</strong>, and a parallel <strong>27-reviewer Tribunal pipeline</strong>. Establishes absolute runtime correctness, optimizes context windows, and heavily mitigates AI code hallucinations.
   </p>
 </div>
 
@@ -173,7 +173,7 @@ AI engineering requires more than static template rules or raw linters. See how
 <!-- SECTION 3 -->
 ## ⚡ State-of-the-Art Performance (Rust Core)
 
-Tribunal Kit v5 splits heavy computational tasks between a native Rust core and a flexible JS orchestrator:
+Tribunal Kit v6 splits heavy computational tasks between a native Rust core and a flexible JS orchestrator:
 
 *   **Compiled Rust Core (`tribunal-core`)**: Powers all deterministic operations, such as path-traversal sandboxing, Levenshtein distance calculations, text merges, and memory database reads to eliminate Node startup latency.
 *   **Zero-Latency Hash Manifests**: File synchronization and updates use SHA-256 incremental hash diffs, copying only modified assets and reducing CLI setup time by **95%**.
@@ -210,7 +210,7 @@ npx tribunal-kit status
 
 Code generation is solved. **Code correctness is the frontier.** 
 
-The Tribunal Pipeline intercepts raw agent generation and routes it through a parallel suite of **19 domain-specific reviewers** before presenting changes to the developer:
+The Tribunal Pipeline intercepts raw agent generation and routes it through a parallel suite of **27 domain-specific reviewers** before presenting changes to the developer:
 
 ```mermaid
 graph TD
@@ -221,7 +221,7 @@ graph TD
     C -.->|Failed| E[Maker Auto-Correction]
     E -.-> C
 
-    D -->|19 Domain Reviewers| F[Human Gate]
+    D -->|27 Domain Reviewers| F[Human Gate]
     F -->|Approved| G((Committed to Disk))
 
     classDef default fill:#1a1a1a,stroke:#333,stroke-width:2px,color:#fff;

package/bin/mcp-server.js

@@ -93,6 +93,10 @@ function searchCaseLaw(query) {
       timeout: SPAWN_TIMEOUT_MS,
     },
   );
+  if (result.error) {
+    if (result.error.code === "ETIMEDOUT") return "Error: Case law search timed out (exceeded 30s limit)";
+    return `Error executing case law search: ${result.error.message}`;
+  }
   return result.stdout || result.stderr || "No results";
 }
 
@@ -107,12 +111,27 @@ function stripBoilerplate(text) {
 }
 
 function handleRequest(req) {
+  if (req.method === "notifications/initialized" || req.method === "notifications/cancelled") {
+    return null;
+  }
+  if (req.method === "ping") {
+    return {};
+  }
+  if (req.method === "resources/list") {
+    return { resources: [] };
+  }
+  if (req.method === "prompts/list") {
+    return { prompts: [] };
+  }
+
   // MCP spec: method names follow path-style convention
   if (req.method === "initialize") {
     return {
       protocolVersion: "2024-11-05",
       capabilities: {
         tools: {},
+        resources: { subscribe: false, listChanged: false },
+        prompts: { listChanged: false },
       },
       serverInfo: {
         name: "tribunal-kit-mcp",
@@ -364,10 +383,12 @@ function handleRequest(req) {
     if (toolName === "get_tribunal_agent") {
       const fs = require("fs");
       const name = req.params?.arguments?.name;
-      if (!name) throw { code: -32602, message: "Missing argument: name" };
-      const path = require("path");
+      if (!name || typeof name !== "string") throw { code: -32602, message: "Missing or invalid argument: name (string)" };
       const sanitizedName = path.basename(name);
-      const agentPath = path.join(process.cwd(), ".agent", "agents", `${sanitizedName}.md`);
+      const agentsDir = path.resolve(process.cwd(), ".agent", "agents");
+      const agentPath = path.resolve(agentsDir, `${sanitizedName}.md`);
+      // Path containment: ensure resolved path stays within agents directory
+      if (!agentPath.startsWith(agentsDir)) throw { code: -32602, message: "Invalid agent name: path traversal detected" };
       if (!fs.existsSync(agentPath)) return { content: [{ type: "text", text: `Agent '${sanitizedName}' not found.` }] };
       const text = fs.readFileSync(agentPath, "utf8");
       return { content: [{ type: "text", text: stripBoilerplate(text) }] };
@@ -384,10 +405,12 @@ function handleRequest(req) {
     if (toolName === "get_tribunal_skill") {
       const fs = require("fs");
       const name = req.params?.arguments?.name;
-      if (!name) throw { code: -32602, message: "Missing argument: name" };
-      const path = require("path");
+      if (!name || typeof name !== "string") throw { code: -32602, message: "Missing or invalid argument: name (string)" };
       const sanitizedName = path.basename(name);
-      const skillPath = path.join(process.cwd(), ".agent", "skills", sanitizedName, "SKILL.md");
+      const skillsDir = path.resolve(process.cwd(), ".agent", "skills");
+      const skillPath = path.resolve(skillsDir, sanitizedName, "SKILL.md");
+      // Path containment: ensure resolved path stays within skills directory
+      if (!skillPath.startsWith(skillsDir)) throw { code: -32602, message: "Invalid skill name: path traversal detected" };
       if (!fs.existsSync(skillPath)) return { content: [{ type: "text", text: `Skill '${sanitizedName}' not found.` }] };
       const text = fs.readFileSync(skillPath, "utf8");
       return { content: [{ type: "text", text: stripBoilerplate(text) }] };
@@ -407,7 +430,8 @@ function handleRequest(req) {
       }
 
       try {
-        const { broker } = require("../.agent/scripts/context_broker.js");
+        const brokerScript = path.join(agentDest, "scripts", "context_broker.js");
+        const { broker } = require(brokerScript);
         const brokerResult = broker(task, files, model, agentDest);
         return { content: [{ type: "text", text: stripBoilerplate(brokerResult.promptText) }] };
       } catch (e) {
@@ -498,7 +522,42 @@ function handleRequest(req) {
   throw { code: -32601, message: `Unknown method: ${req.method}` };
 }
 
+function processSingleRequest(req) {
+  try {
+    const result = handleRequest(req);
+    // If it's a notification, do not send a response
+    if (req.id === undefined || req.id === null) {
+      return null;
+    }
+    return { jsonrpc: "2.0", id: req.id, result };
+  } catch (e) {
+    const code = e && typeof e.code === "number" ? e.code : -32603;
+    const message = e && e.message ? e.message : "Internal server error";
+    if (req.id === undefined || req.id === null) {
+      return {
+        jsonrpc: "2.0",
+        id: null,
+        error: { code, message },
+      };
+    }
+    return {
+      jsonrpc: "2.0",
+      id: req.id,
+      error: { code, message },
+    };
+  }
+}
+
 rl.on("line", (line) => {
+  if (line.length > 1048576) { // 1MB limit
+    const errorRes = {
+      jsonrpc: "2.0",
+      id: null,
+      error: { code: -32700, message: "Parse error: input line too long (exceeds 1MB limit)" },
+    };
+    console.log(JSON.stringify(errorRes));
+    return;
+  }
   if (!line.trim()) return;
 
   let req;
@@ -515,31 +574,22 @@ rl.on("line", (line) => {
     return;
   }
 
-  try {
-    const result = handleRequest(req);
-    const res = { jsonrpc: "2.0", id: req.id, result };
-    console.log(JSON.stringify(res));
-
-    // After initialize, send the initialized notification per MCP spec
-    if (req.method === "initialize") {
-      console.log(
-        JSON.stringify({
-          jsonrpc: "2.0",
-          method: "notifications/initialized",
-          params: {},
-        }),
-      );
+  if (Array.isArray(req)) {
+    const responses = [];
+    for (const singleReq of req) {
+      const response = processSingleRequest(singleReq);
+      if (response) {
+        responses.push(response);
+      }
+    }
+    if (responses.length > 0) {
+      console.log(JSON.stringify(responses));
+    }
+  } else {
+    const response = processSingleRequest(req);
+    if (response) {
+      console.log(JSON.stringify(response));
     }
-  } catch (e) {
-    // Send proper JSON-RPC error response
-    const code = e && typeof e.code === "number" ? e.code : -32603;
-    const message = e && e.message ? e.message : "Internal server error";
-    const errorRes = {
-      jsonrpc: "2.0",
-      id: req.id || null,
-      error: { code, message },
-    };
-    console.log(JSON.stringify(errorRes));
   }
 });
 

package/bin/wrapper.js

@@ -24,6 +24,7 @@ const RUST_COMMANDS = new Set([
   "min-context",
   "dag-schedule",
   "context-compress",
+  "context-broker",
   "optimize-step",
 ]);
 
@@ -87,6 +88,7 @@ function getBinaryPath() {
       const buildResult = spawnSync("cargo", ["build", "--release"], {
         cwd: path.resolve(__dirname, ".."),
         stdio: "ignore",
+        timeout: 60000,
       });
       if (buildResult.status === 0) {
         const releasePath = candidatePaths[0];
@@ -115,10 +117,13 @@ function runRustBinary(binPath, args) {
   });
 
   if (result.error) {
-    console.error(
-      `\x1b[91m✖ Failed to execute Rust engine:\x1b[0m ${result.error.message}`,
+    // Graceful degradation: fall back to JS engine instead of hard-crashing.
+    // Spawn errors include missing binaries, permission denied, corrupted
+    // executables, missing shared libraries, and OS-level exec failures.
+    console.warn(
+      `\x1b[93m⚠ Rust engine failed (${result.error.code || result.error.message}). Falling back to JS engine.\x1b[0m`,
     );
-    process.exit(1);
+    return false; // Signal caller to fall back
   }
 
   process.exit(result.status || 0);
@@ -128,7 +133,10 @@ function runLegacyFallback() {
   // Use the modular dist/ CLI with lazy-loaded commands for faster cold-start.
   // Each command module is require()'d only when invoked (~70% fewer files loaded).
   const { main } = require("../dist/cli.js");
-  main();
+  main().catch((err) => {
+    console.error(`\x1b[91m✖ Fatal Error:\x1b[0m ${err.message || err}`);
+    process.exit(1);
+  });
 }
 
 function main() {
@@ -150,8 +158,11 @@ function main() {
 
       // Route to Rust engine
       // console.log('\x1b[90m⚡ Executing via Rust Core Engine\x1b[0m');
-      runRustBinary(binPath, args);
-      return;
+      const rustResult = runRustBinary(binPath, args);
+      if (rustResult !== false) {
+        return; // Rust engine handled it (process.exit was called)
+      }
+      // rustResult === false means spawn error; fall through to JS fallback
     } else {
       // Warn if Rust command was requested but binary is missing
       console.warn(