bantamkit 0.35.8__tar.gz → 0.35.9__tar.gz

{bantamkit-0.35.8 → bantamkit-0.35.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: bantamkit
-Version: 0.35.8
+Version: 0.35.9
 Summary: Memory MCP server for Claude Code, Cursor, VS Code Copilot and Claude Desktop, plus a Python library that lifts small-model agents. Install once, run offline.
 Project-URL: Homepage, https://github.com/Ink01101011/bantamkit
 Project-URL: Repository, https://github.com/Ink01101011/bantamkit
@@ -103,9 +103,9 @@ CPU architecture and Python minor version** (some wheels, such as `pydantic_core
 one platform only), copy `wheels/` across, and install from it:
 
 ```bash
-python -m pip download "bantamkit[mcp]==0.35.8" -d wheels
+python -m pip download "bantamkit[mcp]==0.35.9" -d wheels
 python -m venv <env>
-<env>/bin/pip install --no-index --find-links wheels "bantamkit[mcp]==0.35.8"
+<env>/bin/pip install --no-index --find-links wheels "bantamkit[mcp]==0.35.9"
 <env>/bin/bantamkit-mcp --install cursor
 ```
 

{bantamkit-0.35.8 → bantamkit-0.35.9}/README.md

@@ -74,9 +74,9 @@ CPU architecture and Python minor version** (some wheels, such as `pydantic_core
 one platform only), copy `wheels/` across, and install from it:
 
 ```bash
-python -m pip download "bantamkit[mcp]==0.35.8" -d wheels
+python -m pip download "bantamkit[mcp]==0.35.9" -d wheels
 python -m venv <env>
-<env>/bin/pip install --no-index --find-links wheels "bantamkit[mcp]==0.35.8"
+<env>/bin/pip install --no-index --find-links wheels "bantamkit[mcp]==0.35.9"
 <env>/bin/bantamkit-mcp --install cursor
 ```
 

{bantamkit-0.35.8 → bantamkit-0.35.9}/src/bantamkit/__init__.py

@@ -29,4 +29,4 @@ from bantamkit.structured import StructuredOutputError, extract_json, structured
 # file as its dynamic version source, so the wheel's metadata and the string the MCP
 # server advertises are the same committed bytes, and neither is a function of when
 # someone last ran `pip`.
-__version__ = "0.35.8"
+__version__ = "0.35.9"

{bantamkit-0.35.8 → bantamkit-0.35.9}/src/bantamkit/assets.py

@@ -26,6 +26,32 @@ def assets_root() -> Path:
     raise AssetNotFound("no assets directory found; set BANTAMKIT_ASSETS")
 
 
+def _asset_path(kind: str, name: str, ext: str) -> Path:
+    """job66/#145: the one path every loader below builds, and the containment check on it.
+
+    `name` is a BARE asset name (`memory`, `shiftwork-checkpoint`, `memory_recall`) and
+    nothing else. Before this, each loader joined `name` under its directory verbatim, so a
+    caller passing user input could read any `.json`/`.md` on disk through `..`. A name
+    holding a path separator (`/` or `\\`, either platform's), `..`, a drive colon or a NUL
+    is refused BEFORE any filesystem access, and the joined path is then checked LEXICALLY
+    (`os.path.abspath`, not `resolve()`: a pack may be a symlink farm, and the check is about
+    the name) to sit directly inside `<root>/<kind>s/`. On Windows `Path("tools") / "C:x"`
+    is drive-relative and leaves the pack, which is what the colon refusal and the lexical
+    check close. The refusal is an `AssetNotFound`, so the MCP resource handler's existing
+    `unknown skill asset: <name>` answer is unchanged. `runtime-ts/src/assets.ts::assetPath`
+    raises the same sentence.
+    """
+    directory = assets_root() / f"{kind}s"
+    path = directory / f"{name}{ext}"
+    if (
+        any(c in name for c in "/\\:\0")
+        or ".." in name
+        or os.path.dirname(os.path.abspath(path)) != os.path.abspath(directory)
+    ):
+        raise AssetNotFound(f"{kind} asset name is not a bare name: {name}")
+    return path
+
+
 def load_tool_asset(name: str) -> dict:
     """Return one tool asset VERBATIM — every key, including the ones no surface uses.
 
@@ -34,7 +60,7 @@ def load_tool_asset(name: str) -> dict:
     register this at all?) and `output_schema` (what do I advertise as the return shape?)
     and neither belongs on the agent-facing `Tool`.
     """
-    path = assets_root() / "tools" / f"{name}.json"
+    path = _asset_path("tool", name, ".json")
     if not path.exists():
         raise AssetNotFound(f"tool asset not found: {path}")
     return json.loads(path.read_text(encoding="utf-8"))
@@ -54,14 +80,14 @@ def load_tool(name: str) -> Tool:
 
 def load_schema(name: str) -> dict:
     """Return a JSON Schema asset (parsed) — e.g. the shift-work checkpoint contract."""
-    path = assets_root() / "schemas" / f"{name}.json"
+    path = _asset_path("schema", name, ".json")
     if not path.exists():
         raise AssetNotFound(f"schema asset not found: {path}")
     return json.loads(path.read_text(encoding="utf-8"))
 
 
 def load_skill(name: str) -> str:
-    path = assets_root() / "skills" / f"{name}.md"
+    path = _asset_path("skill", name, ".md")
     if not path.exists():
         raise AssetNotFound(f"skill asset not found: {path}")
     return path.read_text(encoding="utf-8")

{bantamkit-0.35.8 → bantamkit-0.35.9}/src/bantamkit/hostinstall.py

@@ -40,6 +40,7 @@ import json
 import math
 import os
 import platform
+import re
 import shlex
 import shutil
 import subprocess
@@ -219,13 +220,7 @@ def _write_config(path: Path, data: dict) -> None:
     # API keys in per-server `env` blocks, and a user who chmod'ed theirs to 0600 had it come
     # back 0644 because a fresh temp file gets the process umask. Measured on both runtimes.
     mode = target.stat().st_mode & 0o7777 if target.exists() else None
-    # `ensure_ascii` is left at its DEFAULT, which escapes non-ASCII as `\uXXXX`. That is not
-    # a style choice: `runtime-ts`'s `dumpJson` reproduces `json.dumps` including this, and a
-    # home directory with a non-ASCII name — a Thai or Japanese Windows username, say — would
-    # otherwise make the two runtimes write different bytes for the same install. Escaped
-    # JSON is still JSON and every host parses it; two runtimes disagreeing is the thing that
-    # costs something.
-    payload = json.dumps(data, indent=2) + "\n"
+    payload = _dump_host_json(data, _detected_indent(target)) + "\n"
     try:
         tmp.write_text(payload, encoding="utf-8")
         if mode is not None:
@@ -236,6 +231,45 @@ def _write_config(path: Path, data: dict) -> None:
         raise InstallError(f"cannot write {path}: {exc}") from None
 
 
+def _detected_indent(path: Path) -> str:
+    """The indent unit the file already uses: a tab, or N spaces; two for a new file (#118).
+
+    The unit is read off the FIRST line that starts with whitespace and has something after
+    it. A JSON string cannot hold a raw newline, so every line start is structural and that
+    line is a depth-one member. A file with no such line (absent, empty, all on one line)
+    gets two spaces, which is what this writer always used. `runtime-ts`'s `detectedIndent`
+    applies the same rule to the same text.
+    """
+    try:
+        text = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError):
+        return "  "
+    for line in text.split("\n"):
+        if line[:1] not in (" ", "\t") or not line.strip(" \t\r"):
+            continue
+        if line[0] == "\t":
+            return "\t"
+        return " " * (len(line) - len(line.lstrip(" ")))
+    return "  "
+
+
+# A lone surrogate is all `ensure_ascii=False` leaves unencodable: `"\ud800"` in the host file
+# decodes to one, and UTF-8 cannot carry it. It goes back out as the escape it came in as.
+_LONE_SURROGATE = re.compile("[\ud800-\udfff]")
+
+
+def _dump_host_json(data: dict, indent: str) -> str:
+    """The host file's text: the user's indent unit, non-ASCII as literal UTF-8 (#118).
+
+    `ensure_ascii=False` escapes only `"`, `\\` and C0 controls; everything else, DEL and
+    U+2028 included, is written as itself, so `"ไทย 🎉"` stays `"ไทย 🎉"` rather than coming
+    back as `\\u0e44...`. `runtime-ts` reaches the same bytes from `dumpJson`'s ASCII output
+    (`hostJsonText`), and `tools/conformance/suites/install.mjs` compares the two.
+    """
+    text = json.dumps(data, indent=indent, ensure_ascii=False)
+    return _LONE_SURROGATE.sub(lambda m: f"\\u{ord(m.group()):04x}", text)
+
+
 def _backup_target(path: Path) -> Path:
     """The name the next backup of `path` gets: the first one that is not taken.
 
@@ -743,8 +777,8 @@ def install_hooks(
       5. dated backup, then one atomic write.
 
     The write itself is `_write_config` — the same temp-file replace, the same carried mode,
-    the same `indent=2` and default `ensure_ascii` — so the bytes this leaves and the bytes
-    `--install` leaves are produced by one function (RULING Q3.5).
+    the same detected indent and literal non-ASCII through `_dump_host_json` (#118) — so the
+    bytes this leaves and the bytes `--install` leaves are produced by one function (RULING Q3.5).
     """
     command, extra = this_command()
     rendered = hook_command(command, extra)

{bantamkit-0.35.8 → bantamkit-0.35.9}/src/bantamkit/mcpserver.py

@@ -1405,6 +1405,23 @@ def build_server(memory: Memory, log: EventLog | None = None) -> Any:
         notice = _notice()
         return {**answer, "bantamkit_degraded": notice} if notice else answer
 
+    def _noted_json(document: str) -> str:
+        """A reply that is ONE JSON DOCUMENT rendered as text (`skill_audit`, `token_ledger`),
+        plus the footer if there is one, as a `bantamkit_degraded` key LAST in it (#124).
+
+        `_noted` would append a sentence after the closing brace and the reply would stop
+        parsing. The key is spliced into the text rather than the document being re-parsed,
+        so every byte of a degraded reply before the key is the healthy reply's: `as_json`
+        is `json.dumps(dict, indent=2, ensure_ascii=False)` of a non-empty dict, so it always
+        ends `\\n}`, and the key goes in at that two-space indent, where `json.dumps` would
+        have put it.
+        """
+        notice = _notice()
+        if not notice:
+            return document
+        key = json.dumps(notice, ensure_ascii=False)
+        return f'{document[:-2]},\n  "bantamkit_degraded": {key}\n}}'
+
     def memory_save(
         type: str, name: str, description: str, body: str, links: list[str] | None = None
     ) -> str:
@@ -1772,7 +1789,7 @@ def build_server(memory: Memory, log: EventLog | None = None) -> Any:
                     "omissions": len(result.omissions),
                 },
             )
-            return _noted(result.as_json())
+            return _noted_json(result.as_json())
 
     def repo_map(
         root: str,
@@ -1903,7 +1920,7 @@ def build_server(memory: Memory, log: EventLog | None = None) -> Any:
                     "sessions": len(result.sessions),
                 },
             )
-            return _noted(result.as_json())
+            return _noted_json(result.as_json())
 
     # The served surface, in one place, read out of the asset pack. Adding a tool here
     # without an asset raises AssetNotFound at startup — the manifest cannot drift behind
@@ -2214,8 +2231,50 @@ def _build_parser() -> argparse.ArgumentParser:
     return parser
 
 
+#: job66/#139: the flags that each ACT and then exit, in registration order. At most one of
+#: them may be given. WAS: `_dispatch` ran the first in registration order and dropped the
+#: rest at exit 0, so `--install cursor --assets-root` printed the pack root, wrote no host
+#: config, and told the script that called it nothing.
+_ONE_SHOT_DESTS = (
+    "assets_root",
+    "hook",
+    "mcp_report",
+    "statusline",
+    "update",
+    "install",
+    "install_hooks",
+    "remove_hooks",
+)
+
+
+def _refuse_stacked_one_shots(parser: argparse.ArgumentParser, args: argparse.Namespace) -> None:
+    """Two one-shot flags together are a USAGE error: the usage block, one sentence, exit 2.
+
+    The sentence is argparse's own mutually-exclusive wording, but this is NOT
+    `add_mutually_exclusive_group()`, and the reason is measured: the eight flags are not
+    contiguous in the parser (`--k`, `--index-budget` and `--force` sit between them), and
+    CPython 3.12/3.13 leave a non-contiguous group out of the usage line while 3.14 brackets
+    it as `[--assets-root | --hook | ...]`. A real group would make `-h` depend on the
+    interpreter's minor version, and both `-h` outputs are compared byte for byte with the
+    port's. So the check runs after the parse, over the same actions, and names the two
+    EARLIEST-REGISTERED flags given -- deterministic, and the same order
+    `runtime-ts/src/cli.ts` names them in.
+    """
+    given = [
+        action
+        for action in parser._actions
+        if action.dest in _ONE_SHOT_DESTS and getattr(args, action.dest) not in (None, False)
+    ]
+    if len(given) > 1:
+        first, second = ("/".join(a.option_strings) for a in given[:2])
+        parser.error(f"argument {second}: not allowed with argument {first}")
+
+
 def _parse_args(argv: list[str] | None = None) -> argparse.Namespace:
-    return _build_parser().parse_args(argv)
+    parser = _build_parser()
+    args = parser.parse_args(argv)
+    _refuse_stacked_one_shots(parser, args)
+    return args
 
 
 def _typed_bare_at_a_terminal(
@@ -2381,10 +2440,11 @@ def _check_store_flag(raw: str) -> None:
 def _run_hook(args: argparse.Namespace) -> None:
     """`--hook`: one JSON event on stdin, at most one JSON object on stdout, EXIT 0 ALWAYS.
 
-    DISPATCH ORDER IS REGISTRATION ORDER, which is the rule the flags around it already
-    follow and the reason `--mcp-report --install cursor` prints a report and writes
-    nothing. `--hook` is registered directly after `--index-budget`, so it is checked
-    directly after `--assets-root` -- the same order `runtime-ts/src/cli.ts` checks it in.
+    ALONE ON ITS COMMAND LINE (job66/#139). `--hook` beside another one-shot flag is a usage
+    error at exit 2, and `--store`/`--start`/`--yes`/`--force` beside it are refused at exit
+    1 before this runs. WAS: dispatch order was registration order, so `--mcp-report
+    --install cursor` printed a report and silently wrote nothing, and `--hook --store X`
+    ignored X.
 
     EXIT 0 ALWAYS, AND THAT IS THE CONTRACT, not a convenience. A hook that exits non-zero
     or lets a traceback reach stderr is rendered by the host as an error on the USER'S
@@ -2719,9 +2779,16 @@ def main() -> None:
     Written through `sys.stderr.buffer`, like every other refusal in this file, so the line
     ends LF on Windows too and cannot drift from the port's `process.stderr.write`.
     """
-    if MCPServer is None:
-        raise SystemExit(_INSTALL_HINT)
     args = _parse_args()
+    # job66/#173: the SDK check sits AFTER the parse and is skipped for the arms that never
+    # build a server. `--hook`, `--statusline` and `--mcp-report` are registered with hosts
+    # and run on EVERY event; they import nothing from `mcp`, so a plain `pip install
+    # bantamkit` must run them (docs/hooks.md: the hook "exits 0 always"). WAS: the check ran
+    # before `_parse_args()`, so all three exited 1 with the install hint on every event.
+    if MCPServer is None and not (
+        args.assets_root or args.hook or args.mcp_report or args.statusline
+    ):
+        raise SystemExit(_INSTALL_HINT)
     try:
         _dispatch(args)
     except BantamError as e:
@@ -2731,6 +2798,29 @@ def main() -> None:
 
 
 def _dispatch(args: argparse.Namespace) -> None:
+    # job66/#139: THE MODIFIERS ARE CHECKED BEFORE ANY FLAG ACTS. `_parse_args` already
+    # refuses two one-shot flags together; what is left is a modifier given to a flag that
+    # does not read it. WAS: these two refusals sat after every acting arm, so `--hook --yes`,
+    # `--hook --force` and `--statusline --force` ran the first flag and dropped the modifier
+    # at exit 0 while `--force` alone was refused. Same sentences, same exit 1, earlier.
+    #
+    # `--force` alone is a typo with a plausible reading -- somebody meant to install and
+    # dropped the flag that says where. Refusing names the missing half instead of running
+    # something that ignores it.
+    if args.force and not args.install:
+        raise SystemExit("--force is only meaningful with --install")
+    # The same reading, and the same refusal, for the consent flag. The sentence names BOTH
+    # flags since the ruling of 2026-09-20: naming only one would send an operator who
+    # mistyped `--remove-hooks` looking for a flag they already had.
+    if args.yes and not (args.install_hooks or args.remove_hooks):
+        raise SystemExit("--yes is only meaningful with --install-hooks or --remove-hooks")
+    # REFUSED, NOT HONOURED (job66/#139). The hook binds the store the winning MCP
+    # registration pins, resolved from the cwd the HOST put in the event -- `_run_hook` never
+    # reads `args` -- so `--hook --store X` used to inject nothing from X and say nothing.
+    # Honouring it would give a hook registration a second, competing way to name a store.
+    for flag in ("store", "start"):
+        if args.hook and getattr(args, flag) is not None:
+            raise SystemExit(f"--{flag} is not meaningful with --hook")
     # Before `_build_memory`, which touches the filesystem, and before the server exists at
     # all -- the Node arm returns from `main` here too, ahead of `new RawStdioTransport()`.
     if args.assets_root:
@@ -2751,27 +2841,14 @@ def _dispatch(args: argparse.Namespace) -> None:
     if args.install:
         _run_install(args)
         return
-    # REGISTRATION ORDER AGAIN, which is what makes `--mcp-report --install-hooks` print a
-    # report and write nothing, exactly as `--mcp-report --install cursor` already does.
+    # At most one of these arms can be reached (job66/#139: `_parse_args` refuses a second
+    # one-shot flag), so the order below no longer decides what a stacked argv does.
     if args.install_hooks:
         _run_install_hooks(args)
         return
     if args.remove_hooks:
         _run_remove_hooks(args)
         return
-    # `--force` alone is a typo with a plausible reading -- somebody meant to install and
-    # dropped the flag that says where. Refusing names the missing half instead of starting
-    # a server that ignores it.
-    if args.force:
-        raise SystemExit("--force is only meaningful with --install")
-    # The same reading, and the same refusal, for the consent flag: `--yes` on its own is
-    # somebody who meant to install or remove hooks and dropped the flag that says which. It
-    # is checked AFTER `--force` because that is registration order, and both are checked
-    # after every flag that acts, so `--install-hooks --yes` never reaches either of them. The
-    # sentence names BOTH flags since the ruling of 2026-09-20: naming only one would send an
-    # operator who mistyped `--remove-hooks` looking for a flag they already had.
-    if args.yes:
-        raise SystemExit("--yes is only meaningful with --install-hooks or --remove-hooks")
     # A PERSON TYPED IT. `_typed_bare_at_a_terminal` carries the whole argument; what
     # belongs here is only that this sits BEFORE `_build_memory`, which is what creates a
     # store. Somebody who typed a command to see what it does has not asked for a

{bantamkit-0.35.8 → bantamkit-0.35.9}/src/bantamkit/mcpstdio.py

@@ -17,6 +17,23 @@ for a tool this server serves, whose arguments hold one. Every other line goes t
 byte for byte, as before -- including a lone surrogate anywhere else in a frame, which the SDK
 still drops (the malformed-frame class, not this one).
 
+TWO MORE FRAMES THE SDK DROPPED ARE ANSWERED (job66/#148). A line that is not JSON, or JSON
+that is not a JSON-RPC message (a batch array, a bare number, a request with no `jsonrpc`), went
+the same way: the reader's parse failed, the exception went to the session, nothing was sent.
+JSON-RPC 2.0 section 5.1 prescribes an answer with `id: null`, so the wrapper now asks the SDK's
+own adapter first and, where the SDK would drop the line, answers `-32700 Parse error` (the
+standard library's `json` cannot read it either) or `-32600 Invalid Request` (it can). The
+port writes the same two frames from `runtime-ts/src/mcp/transport.ts`; the `wire` suite
+compares them. A blank line still goes to the SDK and is still dropped, as the port skips it.
+
+A HOST THAT CLOSED ITS READ END ENDS THE SESSION QUIETLY (job66/#181). Measured before this
+change: a 3 MB answer written to a closed stdout raised `BrokenPipeError` out of the SDK's writer,
+and the process then HUNG until stdin closed -- the reader is a blocking `readline` on an anyio
+worker thread, which a cancelled task group must wait for -- and only then died, exit 1, with an
+exception-group traceback. Stdin is now read on a DAEMON thread, so a cancelled reader is
+abandoned rather than awaited, and the broken pipe is caught: exit 0, nothing on stderr, the
+same as the port and the same as stdin EOF.
+
 PRIVATE SDK NAMES, ON PURPOSE. `_claim_fd`, `_open_stdin_diversion`, `_UnownedTextWrapper`
 and `MCPServer._lowlevel_server` are not public API. They are what `stdio_server()` and
 `run_stdio_async()` themselves use, the SDK is upper-capped in `runtime-py/pyproject.toml`
@@ -26,13 +43,14 @@ child a handler spawns. A rename inside the cap fails at import or at first use,
 
 from __future__ import annotations
 
+import asyncio
 import json
 import re
 import sys
+import threading
 from collections.abc import AsyncIterator
 from typing import Any
 
-import anyio
 import mcp_types as types
 from mcp.server import stdio as _sdk_stdio
 from mcp.shared.message import SessionMessage
@@ -110,8 +128,87 @@ def refusal_for(line: str, tools: frozenset[str]) -> types.JSONRPCResponse | Non
     )
 
 
+def _no_constant(name: str) -> Any:
+    raise ValueError(f"not JSON: {name}")
+
+
+def malformed_frame_error(line: str) -> types.JSONRPCError | None:
+    """The `id: null` error for a line the SDK's reader would drop, or `None` (#148).
+
+    `-32700` when the line is not JSON at all -- `NaN` and `Infinity` included, which
+    `json.loads` would otherwise accept and JSON does not -- and `-32600` when it is JSON
+    but not a message the SDK's own adapter accepts. A blank line is `None`: it is skipped,
+    not answered, on both runtimes.
+    """
+    if not line.strip():
+        return None
+    # pydantic's parser reads `NaN` and `Infinity` where JSON has none; the port's
+    # `JSON.parse` does not. Only a line spelling one can hold one, so only that line pays.
+    if ("NaN" in line or "Infinity" in line) and not _is_strict_json(line):
+        return _error(-32700, "Parse error")
+    try:
+        types.jsonrpc_message_adapter.validate_json(line, by_name=False)
+    except Exception:  # noqa: BLE001 - the SDK's reader catches exactly this broadly
+        pass
+    else:
+        return None
+    # A lone surrogate lands here too: `json` reads it, pydantic's parser does not.
+    if _is_strict_json(line):
+        return _error(-32600, "Invalid Request")
+    return _error(-32700, "Parse error")
+
+
+def _is_strict_json(line: str) -> bool:
+    try:
+        json.loads(line, parse_constant=_no_constant)
+    except ValueError:
+        return False
+    return True
+
+
+def _error(code: int, message: str) -> types.JSONRPCError:
+    error = types.ErrorData(code=code, message=message)
+    return types.JSONRPCError(jsonrpc="2.0", id=None, error=error)
+
+
+class _DaemonLines:
+    """The lines of a text stream, read on a DAEMON thread (#181).
+
+    `anyio.wrap_file` reads on a worker thread the task group has to wait for, so a session
+    whose stdout broke could not end until stdin did. A daemon thread is abandoned instead.
+    One line is read ahead at most: the thread blocks until the loop has taken the last one.
+    """
+
+    def __init__(self, text: Any) -> None:
+        self._text = text
+
+    def __aiter__(self) -> AsyncIterator[str]:
+        return self._lines()
+
+    async def _lines(self) -> AsyncIterator[str]:
+        loop = asyncio.get_running_loop()
+        queue: asyncio.Queue[str | None] = asyncio.Queue(maxsize=1)
+
+        def pump() -> None:
+            try:
+                for line in self._text:
+                    asyncio.run_coroutine_threadsafe(queue.put(line), loop).result()
+            except (OSError, ValueError, RuntimeError):
+                pass  # the fd was released or the loop is gone: nobody is reading any more
+            finally:
+                try:
+                    asyncio.run_coroutine_threadsafe(queue.put(None), loop)
+                except RuntimeError:
+                    pass
+
+        threading.Thread(target=pump, name="bantamkit-stdin", daemon=True).start()
+        while (line := await queue.get()) is not None:
+            yield line
+
+
 class _Lines:
-    """The SDK's stdin, with the lone-surrogate `tools/call` frames answered and withheld."""
+    """The SDK's stdin, with the lone-surrogate `tools/call` frames answered and withheld,
+    and the frames the SDK would drop answered `-32700`/`-32600` (#148)."""
 
     def __init__(self, inner: Any, tools: frozenset[str]) -> None:
         self._inner = inner
@@ -123,7 +220,9 @@ class _Lines:
 
     async def _lines(self) -> AsyncIterator[str]:
         async for line in self._inner:
-            response = refusal_for(line, self._tools) if self.write_stream is not None else None
+            response: types.JSONRPCResponse | types.JSONRPCError | None = None
+            if self.write_stream is not None:
+                response = refusal_for(line, self._tools) or malformed_frame_error(line)
             if response is None:
                 yield line
             else:
@@ -136,11 +235,14 @@ async def serve_stdio(server: Any) -> None:
     buffer, release = _sdk_stdio._claim_fd(0, sys.stdin, "rb", _sdk_stdio._open_stdin_diversion)
     try:
         text = _sdk_stdio._UnownedTextWrapper(buffer, encoding="utf-8", errors="replace")
-        lines = _Lines(anyio.wrap_file(text), tools)
+        lines = _Lines(_DaemonLines(text), tools)
         async with _sdk_stdio.stdio_server(stdin=lines) as (read_stream, write_stream):  # type: ignore[arg-type]
             lines.write_stream = write_stream
             lowlevel = server._lowlevel_server
             await lowlevel.run(read_stream, write_stream, lowlevel.create_initialization_options())
+    except* (BrokenPipeError, ConnectionResetError):
+        # The host closed its read end (#181): the session is over, exactly as on stdin EOF.
+        pass
     finally:
         if release is not None:
             release()

{bantamkit-0.35.8 → bantamkit-0.35.9}/src/bantamkit/tokenledger.py

@@ -69,6 +69,16 @@ THE PARITY HAZARDS, EACH PINNED
   same measured hole.
 - **A bare `Infinity`.** `json.loads` accepts the token and `JSON.parse` throws. The line
   decoder closes it, so a transcript carrying one is `unparsed-line` on both sides.
+- **A leading UTF-8 BOM** (#150). `read_text(encoding="utf-8")` keeps U+FEFF and `json.loads`
+  refuses it, while a default `TextDecoder` strips it from the FIRST line only. The port decodes
+  with `ignoreBOM: true`, so a BOM is `unparsed-line` on both sides, on any line. Tolerating it
+  instead was the other choice and was not taken: the host never writes one, RFC 8259 forbids
+  adding one, and a line that is not what the host writes is exactly what an omission names.
+- **Directory symlinks** (#151). `Path.is_dir()` and `statSync` both FOLLOW a link, so a link
+  to an ancestor was walked until the OS refused it (ELOOP, ~32 levels on macOS) and the one
+  transcript beneath it was counted once per level. A symlinked directory is now neither
+  descended into nor read, on both sides -- `skill_audit`'s rule (`os.walk`'s
+  `followlinks=False`). A symlink to a FILE is still read: it cannot loop.
 
 THE COST IS THE REFUSAL, AND THAT IS THE NORMAL ANSWER
 ------------------------------------------------------
@@ -261,6 +271,12 @@ class _Accumulator:
             self.tokens = {cls: 0 for cls in TOKEN_CLASSES}
 
 
+def _is_junction(path: Path) -> bool:
+    """`Path.is_junction()` where it exists (3.12+); before it, no junction is named."""
+    probe = getattr(path, "is_junction", None)
+    return bool(probe()) if probe is not None else False
+
+
 def _walk(base: Path) -> list[tuple[Path, str]]:
     """Every `*.jsonl` under `base`, in one deterministic order, each with the name it is called by.
 
@@ -285,7 +301,12 @@ def _walk(base: Path) -> list[tuple[Path, str]]:
             child = directory / name
             rel = f"{prefix}{name}"
             if child.is_dir():
-                visit(child, f"{rel}/")
+                # #151: a symlinked directory is not a transcript tree. `is_dir()` follows the
+                # link, so a link to a directory lands in this arm and is skipped here: neither
+                # walked nor read. Node's `lstatSync` calls a Windows junction a symbolic link,
+                # so a junction is skipped too where this Python can name one.
+                if not (child.is_symlink() or _is_junction(child)):
+                    visit(child, f"{rel}/")
             elif name.endswith(TRANSCRIPT_SUFFIX):
                 found.append((child, rel))
 

{bantamkit-0.35.8 → bantamkit-0.35.9}/src/bantamkit/updatecheck.py

@@ -119,6 +119,7 @@ from __future__ import annotations
 
 import json
 import re
+import sys
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
@@ -151,6 +152,7 @@ __all__ = [
     "decide",
     "update_status",
     "update_line",
+    "update_command",
 ]
 
 #: The key of the record THIS runtime reads. Divergent by construction: `runtime-ts` reads
@@ -173,9 +175,16 @@ UPDATE_NEVER = "update: never checked."
 
 #: The whole point of the feature. `{latest}` and `{installed}` are BOTH here so the reader
 #: can falsify the claim, the same reason `selfupdate.COMPARISON` carries both.
+#:
+#: `{command}` is `update_command()` (job66/#171). WAS: `` `{program} --update` ``, the bare
+#: command, which a pip venv or an npm kept install puts on nobody's PATH -- so the sentence
+#: answered `command not found` from a GUI-launched host's shell. The TEMPLATE is still
+#: byte-identical across runtimes; what each runtime fills into `{command}` is its own
+#: interpreter and entry point (the `docs/porting.md` row *the update command names each
+#: runtime's own interpreter*).
 UPDATE_AVAILABLE = (
     "update: {program} {installed} is running; the package index has {latest} — run "
-    "`{program} --update`, then reconnect the host."
+    "`{command}`, then reconnect the host."
 )
 
 #: Names the date because the record may be months old.
@@ -347,11 +356,24 @@ def _checked_date(record: dict[str, Any], key: str) -> str | None:
     return found.group(1) if found else None
 
 
+def update_command() -> str:
+    """The command `UPDATE_AVAILABLE` tells the operator to run: THIS interpreter, absolute.
+
+    job66/#171. `sys.executable`, double-quoted, then `-m bantamkit.mcpserver --update` --
+    the interpreter that is running this server, so the command needs no PATH (a host
+    launched from a GUI gets `/usr/bin:/bin`) and runs the same install that answered. The
+    quotes hold a home directory with a space in it. The port fills in `process.execPath`
+    and its own `cli.js` instead.
+    """
+    return f'"{sys.executable}" -m bantamkit.mcpserver --update'
+
+
 def decide(
     installed: str,
     source: str,
     record: dict[str, Any] | None,
     key: str = KEY,
+    command: str | None = None,
 ) -> UpdateStatus:
     """The five-state decision, pure: no filesystem, no clock, no network, no TTL.
 
@@ -370,7 +392,12 @@ def decide(
     if order < 0:
         return UpdateStatus(
             STATE_AVAILABLE,
-            UPDATE_AVAILABLE.format(program=PROGRAM, installed=installed, latest=latest),
+            UPDATE_AVAILABLE.format(
+                program=PROGRAM,
+                installed=installed,
+                latest=latest,
+                command=update_command() if command is None else command,
+            ),
         )
     if order == 0:
         return UpdateStatus(
@@ -387,16 +414,18 @@ def update_status(
     installed: str,
     key: str = KEY,
     path: Path | None = None,
+    command: str | None = None,
 ) -> UpdateStatus:
     """Read the record and decide. The whole reader, in one call, for `bantamkit_status`."""
     source, record = load_record(path)
-    return decide(installed, source, record, key)
+    return decide(installed, source, record, key, command)
 
 
 def update_line(
     installed: str,
     key: str = KEY,
     path: Path | None = None,
+    command: str | None = None,
 ) -> str:
     """Exactly one of the five sentences. Always a line: there is no silent state here."""
-    return update_status(installed, key, path).line
+    return update_status(installed, key, path, command).line