navi-3d: a session id is a path segment, and it stops being a way out ...

The 3D server resolves paths itself, so the sandbox in areas.py never applies
to it: what Settings.resolve_path accepts, the tool opens, creates or
overwrites. It joined session_id onto session_files/ unvalidated, so
"../../../../.." resolved to "/" and every relative path was then "inside";
and it left ".." in a relative path unresolved before its containment check,
which is lexical — "../<other session>/x.scad" passed and only the OS
collapsed it at open time.

designer_3d grants navi-3d to the agent and to its subagents, so this was
host-wide read and write — compile_scad even creates the output's parent
directories — for an ordinary user, with the profile prompt as the only thing
in the way.

The id is validated as one segment now, and both branches resolve before
checking, which also catches a symlink leading out.

McpTool: auto-inject session_id + normalize navi-3d paths ...

- McpTool.execute() now forces the real session_id from current_session_id
  ContextVar, preventing LLM hallucinations of wrong UUIDs (ghost-session bug).
- For navi-3d MCP server, source_path/output_path are normalized to basename
  to prevent double path nesting when the LLM passes full relative paths.
- Updated MCP tool descriptions to ask for filenames only.
- Added system prompt instructions in context_builder and subagent_runner
  reminding the model to pass bare filenames to navi-3d tools.

396 passed, 1 skipped

chore: remove test MCP servers from repo ...

project_health and time_toolkit were created for development testing
and should not be part of the committed codebase.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

feat: MCP server template, manual, and example servers ...

Add canonical scaffolding for MCP server development:

- manuals/write_mcp_server.md: full guide covering structure, validation,
  smoke-testing, registration, and troubleshooting
- mcp-servers/_template/: annotated starter with annotated mcp_server.py
  and pyproject.toml for FastMCP + pydantic
- mcp-servers/project_health/: example server with 3 tools
  (get_project_summary, find_duplicate_files, get_project_dependencies)
- mcp-servers/time_toolkit/: example server with 4 tools
  (get_current_time, convert_timezone, add_time, format_datetime)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Rename MCP tools to mcp:server:tool format and restore human-readable names ...

- Core naming: mcp_server_tool → mcp:server:tool (colon-delimited)
- navi-web tools: search/view/request → web_search/web_view/http_request
- navi-3d tools: compile_scad/render_stl/lint_scad (unchanged names)
- Updated all profile configs, system prompts, docs, manuals, tests
- Added new lint_scad.md manual
- Fixed modeler_3d prompt stale references (scad_lint, model_3d, render_3d)
- All 240 tests pass

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Rename navi-web MCP tools and compact search output ...

- web_search → search, web_view → view, http_request → request
  This removes the redundant 'web' prefix from tool names in the
  navi-web MCP server, making them cleaner: mcp_navi-web_search etc.

- Compact search output: output string now contains only
  [Source] + [N] Title — URL, without duplicating the body snippet.
  Full results with body/description remain in metadata for
  programmatic use.

- Updated mcp_servers.json groups and all profile configs.

Tests: 240 passed.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Migrate web tools (web_search, web_view, http_request) to navi-web MCP server ...

New MCP server: mcp-servers/navi-web/
- app/search.py    — SearXNG primary, DDG fallback, Brave tertiary
- app/browse.py    — Playwright headless browser page extraction
- app/request.py   — httpx raw HTTP requests
- app/mcp_server.py — FastMCP entry point with stdio transport
- pyproject.toml   — deps: mcp, httpx, ddgs, playwright, pydantic

Changes:
- Added "navi-web" block to mcp_servers.json (stdio transport)
- Removed web_search, web_view, http_request from built-in registry
- Removed them from navi/tools/__init__.py
- Removed them from enabled_tools / subagent_tools in all profiles
- Added "navi-web": ["search", "browse", "request"] to mcp_servers
  in all profiles (developer, secretary, server_admin, tool_developer,
  modeler_3d, discuss)

Tests: 240 passed.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix navi-3d MCP tool coroutine serialization error ...

All three tool handlers (compile_scad, render_stl, lint_scad) were
calling async core functions without await from synchronous def bodies.
This caused FastMCP to receive a coroutine object instead of a dict,
which then failed JSON serialization with:
  Object of type coroutine is not JSON serializable

Fix: convert tool handlers to async def and await the underlying
compile_scad / render_stl / lint_scad calls before passing to _json().

Tested via stdio_client — lint_scad now returns clean JSON result.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix navi-3d MCP tool name mismatch ...

The MCP server registered tools with `_tool` suffix (e.g. lint_scad_tool)
but mcp_servers.json groups listed bare names (lint_scad). This caused
_tool_list() to look for mcp_navi-3d_lint_scad which never existed in the
registry — the actual registered tool was mcp_navi-3d_lint_scad_tool.

Fix: explicitly set name= on @mcp.tool() decorators so MCP tool names
match the group whitelist in mcp_servers.json.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Migrate 3D modeling tools to standalone MCP server navi-3d ...

Phase 0 — Fix MCP error propagation:
- McpClient.call_tool now returns (output, is_error) tuple
- McpTool.execute sets success=False when MCP reports isError=True
- Fixes silent failures where MCP errors looked like success

Phase 1 — Create mcp-server-navi-3d:
- New standalone MCP server in mcp-servers/navi-3d/
- Tools: compile_scad, render_stl, lint_scad
- Session-scoped path resolution via SESSION_FILES_DIR env
- Anti-escape validation for security
- Includes tests/unit/test_scad_analyze.py

Phase 2 — Remove from Navi core:
- Deleted navi/tools/{model_3d,render_3d,scad_lint}.py
- Removed from registry.py builtins and navi/tools/__init__.py
- Updated pyproject.toml testpaths to exclude mcp-servers/

Phase 3 — Wire into Navi config:
- Added navi-3d block to mcp_servers.json (SSE on :8002)
- Updated modeler_3d profile: mcp_servers + updated system_prompt
- All old tool names replaced with mcp_navi-3d_* equivalents

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>