[markmnl]

Added recipients can reply

A recipient added to a message after it was sent could not reply to it. reply / create_draft(reply_to=…) failed with:

403 not a participant of this parent; added recipients must use their batch sha256

fmsg-webapi accepts such a reply only when the parent is given as the sha256 of the add-to batch that added the caller. Each add_to batch already carries that hash. No tool used it.

• When the caller is on the parent only as an added recipient, the draft's pid is that batch's hash. send_draft needs no change because the draft already carries it. Senders and primary recipients still send the numeric id. So does a host that gives no batch hash, since such a host predates the rule.
• A reply to an earlier message in the thread fails, because an added recipient cannot read or reply to it. The error now names the message to reply to: "You were added to message X in the same thread after it was sent, so you can reply to message X instead". It finds X by searching the caller's recent inbox (at most 5 pages and 20 threads, only on this error path). If nothing is found, the host's error stands.
• New src/tools/parent.ts. The fake Web API now hashes messages and batches and enforces the same participant rule.

whoami reports the version

The whoami description promised the server version, but the version was only in the text. Hosts that show models only the structured result never pass the text on. Builds from source also reported package.json's stale 0.1.4.

• whoami adds server_version, plus server_commit and server_build (git describe) when recorded. /healthz adds commit.
• npm run build writes dist/build-info.json. The version comes from FMSG_MCP_VERSION, else the latest v* tag. The commit comes from FMSG_MCP_COMMIT, else git. The Dockerfile takes both as build args, because its context has no .git. FMSG_MCP_COMMIT also works at run time. package.json and server.json now say 1.2.3.
• Trade-off: whoami leaves the test list of tools whose closed 0.2.5 output schema must still validate. A host still holding that 0.2.5 schema would reject the new fields. owner already exceeds that schema for sub-addresses, and adding optional fields is the documented policy.

Tests

• test/added-recipients.test.ts: reply, create_draft → send_draft, replying higher up the thread (404 and 403), an unrelated message, numeric ids for sender and recipients, and a host without batch hashes.
• whoami structured version, FMSG_MCP_COMMIT, the stdio binary reporting dist/build-info.json, and /healthz.
• npm run typecheck && npm run build && npm test: 262 passed. Docker build checked locally with podman: build info recorded, --version prints 1.2.3.

🤖 Generated with Claude Code