@aexol/spectral 0.9.55 → 0.9.59

package/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to `@aexol/spectral` are documented here. Format follows
 
 ## [Unreleased]
 
+### Added
+
+- Added built-in `web_fetch` tool for fetching public web pages as text,
+  Markdown, or raw HTML. Includes SSRF protection, redirect handling, timeout
+  and size limits, plus unit and integration tests.
+
 ## [0.9.40] - 2026-06-22
 
 ## [0.9.39] - 2026-06-22

package/README.md

@@ -151,6 +151,49 @@ sends it anywhere. Note that `spectral serve` does **not** use this file — it
 routes inference through the backend proxy instead (see
 [How inference is routed](#how-inference-is-routed)).
 
+## Web Fetch tool
+
+Spectral ships a built-in `web_fetch` tool (enabled by default) for fetching
+public web pages and returning their content as plain text, Markdown, or raw
+HTML. It is intended for quickly reading static pages, documentation, GitHub
+repositories, JSON endpoints, and other public HTTP/HTTPS resources.
+
+### Parameters
+
+| Parameter | Type     | Default    | Description                                                                 |
+| --------- | -------- | ---------- | --------------------------------------------------------------------------- |
+| `url`     | string   | required   | Public URL to fetch. Must begin with `http://` or `https://`.               |
+| `format`  | string   | `markdown` | Output format: `text`, `markdown`, or `html`.                               |
+| `timeout` | number   | `30`       | Request timeout in seconds, clamped to the range `1`–`120`.                 |
+
+### When to use `web_fetch`
+
+Use `web_fetch` when you only need to **read** publicly available content:
+
+- Static documentation sites and README pages.
+- GitHub file, blob, or raw URLs.
+- Public JSON/XML APIs (e.g., Reddit JSON endpoints).
+- Simple marketing pages or blogs that render their main content server-side.
+
+`web_fetch` is fast, lightweight, and does not require a browser. It applies
+SSRF protection by rejecting `file://`, `ftp://`, `localhost`, and private IP
+addresses, and it limits responses to 5 MB.
+
+### When to use the Browser extension instead
+
+Use the full **Browser Automation** extension (also enabled by default) when the
+page requires a real browser:
+
+- JavaScript-rendered SPAs where the markup is produced in the browser.
+- Pages that need interaction (clicks, scrolling, form input) before the
+  relevant content appears.
+- Sites that block simple HTTP clients or require cookies / session state.
+- Screenshots, visual verification, or network-traffic inspection.
+
+The Browser extension controls a real Chromium instance via Playwright and can
+do everything `web_fetch` can, plus interaction, screenshots, and JavaScript
+evaluation.
+
 ## Multiple machines
 
 You can run `spectral serve` on as many machines as you like under one team —

package/dist/agent/index.d.ts

@@ -18,14 +18,19 @@
  *
  * Subagents use an in-process `agentLoop()` for:
  *   - Clean context isolation (fresh messages array)
- *   - Combined system prompt (main agent + subagent-specific instructions)
+ *   - Combined system prompt (shared/base prompt + subagent-specific instructions)
  *   - Tool filtering (only the tools specified in agent config)
  *   - Model selection (session model preferred, agent-configured as fallback)
  *   - Signal propagation (abort passthrough)
  *   - Access to observational memory via the recall tool
  */
 import { type ExtensionAPI } from "../sdk/coding-agent/index.js";
+import { type AgentConfig } from "./agents.js";
+import type { ServerEvent } from "../server/wire.ts";
+export declare function stripInjectedPrimaryAgentPrompt(systemPrompt: string | undefined): string | undefined;
+export declare function buildSubagentSystemPrompt(baseSystemPrompt: string | undefined, agent: Pick<AgentConfig, "name" | "systemPrompt">): string;
 export default function subagentExtension(ext: ExtensionAPI, opts?: {
     disabledAgents?: string[];
+    emitSubagentEvent?: (event: ServerEvent) => void;
 }): void;
 //# sourceMappingURL=index.d.ts.map

package/dist/agent/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAWH,OAAO,EACN,KAAK,YAAY,EAEjB,MAAM,8BAA8B,CAAC;AAsftC,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CA+UvG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAYH,OAAO,EACN,KAAK,YAAY,EAEjB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,KAAK,WAAW,EAAmC,MAAM,aAAa,CAAC;AAEhF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAsFrD,wBAAgB,+BAA+B,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CASpG;AAED,wBAAgB,yBAAyB,CACxC,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAAC,GAC/C,MAAM,CAKR;AAkdD,MAAM,CAAC,OAAO,UAAU,iBAAiB,CACxC,GAAG,EAAE,YAAY,EACjB,IAAI,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAA;CAAE,GACpF,IAAI,CAgZN"}

package/dist/agent/index.js

@@ -18,7 +18,7 @@
  *
  * Subagents use an in-process `agentLoop()` for:
  *   - Clean context isolation (fresh messages array)
- *   - Combined system prompt (main agent + subagent-specific instructions)
+ *   - Combined system prompt (shared/base prompt + subagent-specific instructions)
  *   - Tool filtering (only the tools specified in agent config)
  *   - Model selection (session model preferred, agent-configured as fallback)
  *   - Signal propagation (abort passthrough)
@@ -40,6 +40,8 @@ import { wrapToolDefinition } from "../sdk/coding-agent/core/tools/tool-definiti
 // ---------------------------------------------------------------------------
 const MAX_PARALLEL_TASKS = 8;
 const MAX_CONCURRENCY = 4;
+const PRIMARY_AGENT_PROMPT_HEADER = "# Primary Agent:";
+const PRIMARY_AGENT_PROMPT_DELIMITER = "\n\n---\n\n";
 // ---------------------------------------------------------------------------
 // Helpers — formatting
 // ---------------------------------------------------------------------------
@@ -73,6 +75,52 @@ function formatUsageStats(usage, model) {
         parts.push(model);
     return parts.join(" ");
 }
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function textFromToolResultContent(value) {
+    if (!isRecord(value) || !Array.isArray(value.content))
+        return undefined;
+    const parts = [];
+    for (const part of value.content) {
+        if (isRecord(part) && part.type === "text" && typeof part.text === "string") {
+            parts.push(part.text);
+        }
+    }
+    const text = parts.join("").trim();
+    return text ? text : undefined;
+}
+function compactProgressMessage(value) {
+    const text = typeof value === "string" ? value.trim() : textFromToolResultContent(value);
+    if (text)
+        return text.length > 240 ? `${text.slice(0, 237)}...` : text;
+    if (isRecord(value) && typeof value.message === "string" && value.message.trim()) {
+        const message = value.message.trim();
+        return message.length > 240 ? `${message.slice(0, 237)}...` : message;
+    }
+    if (isRecord(value) && typeof value.error === "string" && value.error.trim()) {
+        const error = value.error.trim();
+        return error.length > 240 ? `${error.slice(0, 237)}...` : error;
+    }
+    return value === undefined ? undefined : "Tool progress updated";
+}
+export function stripInjectedPrimaryAgentPrompt(systemPrompt) {
+    if (!systemPrompt)
+        return systemPrompt;
+    if (!systemPrompt.startsWith(PRIMARY_AGENT_PROMPT_HEADER))
+        return systemPrompt;
+    const delimiterIndex = systemPrompt.indexOf(PRIMARY_AGENT_PROMPT_DELIMITER);
+    if (delimiterIndex === -1)
+        return undefined;
+    const basePrompt = systemPrompt.slice(delimiterIndex + PRIMARY_AGENT_PROMPT_DELIMITER.length);
+    return basePrompt.trim().length > 0 ? basePrompt : undefined;
+}
+export function buildSubagentSystemPrompt(baseSystemPrompt, agent) {
+    const sharedSystemPrompt = stripInjectedPrimaryAgentPrompt(baseSystemPrompt);
+    return sharedSystemPrompt
+        ? `${sharedSystemPrompt}\n\n---\n\nSubagent: ${agent.name}\n${agent.systemPrompt}`
+        : agent.systemPrompt;
+}
 // ---------------------------------------------------------------------------
 // Helpers — message extraction
 // ---------------------------------------------------------------------------
@@ -176,7 +224,7 @@ async function mapWithConcurrencyLimit(items, concurrency, fn) {
 // ---------------------------------------------------------------------------
 // Core — run a single subagent in-process via agentLoop
 // ---------------------------------------------------------------------------
-async function runSingleAgent(defaultCwd, agents, agentName, task, cwd, step, signal, onUpdate, makeDetails, ext, ctx) {
+async function runSingleAgent(defaultCwd, agents, agentName, task, cwd, step, signal, onUpdate, makeDetails, parentToolCallId, onInternalEvent, ext, ctx) {
     const normalizedAgentName = agentName.replace(/^@/, "");
     const agent = agents.find((a) => a.name === normalizedAgentName);
     if (!agent) {
@@ -192,11 +240,9 @@ async function runSingleAgent(defaultCwd, agents, agentName, task, cwd, step, si
             step,
         };
     }
-    // Build combined system prompt: main agent's + subagent's
-    const mainSystemPrompt = ctx.getSystemPrompt();
-    const combinedPrompt = mainSystemPrompt
-        ? `${mainSystemPrompt}\n\n---\n\nSubagent: ${agent.name}\n${agent.systemPrompt}`
-        : agent.systemPrompt;
+    // Build combined system prompt without leaking an injected primary-agent
+    // block into the isolated subagent context.
+    const combinedPrompt = buildSubagentSystemPrompt(ctx.getSystemPrompt(), agent);
     // Apply system prompt mutation if enabled in settings (opt-in)
     let effectivePrompt = combinedPrompt;
     if (ctx.settingsManager) {
@@ -259,11 +305,19 @@ async function runSingleAgent(defaultCwd, agents, agentName, task, cwd, step, si
     };
     // Accumulated streaming text from text_delta events (reset per assistant turn).
     let streamingText = "";
+    // Accumulated thinking deltas for the live subagent sheet. This stays outside
+    // final `SingleResult` so the public subagent tool_result contract is unchanged.
+    let thinkingText = "";
     const emitUpdate = () => {
         if (onUpdate) {
+            const liveResult = {
+                ...currentResult,
+                ...(streamingText ? { streamingText } : {}),
+                ...(thinkingText ? { thinkingText } : {}),
+            };
             onUpdate({
-                content: [{ type: "text", text: getFinalOutput(currentResult.messages) || streamingText || "(running...)" }],
-                details: makeDetails([currentResult]),
+                content: [{ type: "text", text: getFinalOutput(currentResult.messages) || streamingText || (thinkingText ? "(thinking...)" : "(running...)") }],
+                details: makeDetails([liveResult]),
             });
         }
     };
@@ -288,14 +342,19 @@ async function runSingleAgent(defaultCwd, agents, agentName, task, cwd, step, si
                 hadError = true;
                 break;
             }
+            onInternalEvent?.(event, parentToolCallId);
             if (event.type === "message_update" && event.message?.role === "assistant") {
-                // Forward streaming text deltas so the UI can show the subagent's
-                // response as it's generated, not just the final result.
+                // Forward streaming text/thinking deltas so the UI can show the
+                // subagent process as it's generated, not just the final result.
                 const inner = event.assistantMessageEvent;
                 if (inner?.type === "text_delta" && inner.delta) {
                     streamingText += inner.delta;
                     emitUpdate();
                 }
+                else if (inner?.type === "thinking_delta" && inner.delta) {
+                    thinkingText += inner.delta;
+                    emitUpdate();
+                }
                 continue;
             }
             if (event.type === "message_end" && event.message) {
@@ -451,6 +510,66 @@ export default function subagentExtension(ext, opts) {
                 projectAgentsDir: discovery.projectAgentsDir,
                 results,
             });
+            // Forward internal subagent tool lifecycle events to the bridge so the
+            // frontend sheet can show a live activity log. text_delta streaming
+            // still flows through the existing onUpdate/subagent_progress path.
+            const emitSubagentEvent = opts?.emitSubagentEvent;
+            const subagentStepStartedAt = new Map();
+            const subagentStepArgs = new Map();
+            const emitSubagentToolProgress = emitSubagentEvent
+                ? (event, parentToolCallId) => {
+                    if (event.type === "tool_execution_start") {
+                        const startedAt = Date.now();
+                        subagentStepStartedAt.set(event.toolCallId, startedAt);
+                        subagentStepArgs.set(event.toolCallId, event.args);
+                        emitSubagentEvent({
+                            type: "subagent_tool_progress",
+                            toolCallId: parentToolCallId,
+                            stepId: event.toolCallId,
+                            name: event.toolName,
+                            args: event.args,
+                            status: "running",
+                            startedAt,
+                        });
+                    }
+                    else if (event.type === "tool_execution_update") {
+                        const startedAt = subagentStepStartedAt.get(event.toolCallId) ?? Date.now();
+                        subagentStepStartedAt.set(event.toolCallId, startedAt);
+                        subagentStepArgs.set(event.toolCallId, event.args);
+                        emitSubagentEvent({
+                            type: "subagent_tool_progress",
+                            toolCallId: parentToolCallId,
+                            stepId: event.toolCallId,
+                            name: event.toolName,
+                            args: event.args,
+                            status: "running",
+                            partialResult: event.partialResult,
+                            message: compactProgressMessage(event.partialResult),
+                            startedAt,
+                        });
+                    }
+                    else if (event.type === "tool_execution_end") {
+                        const startedAt = subagentStepStartedAt.get(event.toolCallId) ?? Date.now();
+                        const finishedAt = Date.now();
+                        const args = subagentStepArgs.get(event.toolCallId);
+                        subagentStepStartedAt.delete(event.toolCallId);
+                        subagentStepArgs.delete(event.toolCallId);
+                        emitSubagentEvent({
+                            type: "subagent_tool_progress",
+                            toolCallId: parentToolCallId,
+                            stepId: event.toolCallId,
+                            name: event.toolName,
+                            args,
+                            status: event.isError ? "error" : "success",
+                            result: event.result,
+                            isError: event.isError,
+                            message: event.isError ? compactProgressMessage(event.result) : undefined,
+                            startedAt,
+                            finishedAt,
+                        });
+                    }
+                }
+                : undefined;
             if (modeCount !== 1) {
                 const available = agents.map((a) => `${a.name} (${a.source})`).join(", ") || "none";
                 return {
@@ -513,7 +632,7 @@ export default function subagentExtension(ext, opts) {
                             }
                         }
                         : undefined;
-                    const result = await runSingleAgent(ctx.cwd, agents, step.agent, taskWithContext, step.cwd, i + 1, signal, chainUpdate, makeDetails("chain"), ext, ctx);
+                    const result = await runSingleAgent(ctx.cwd, agents, step.agent, taskWithContext, step.cwd, i + 1, signal, chainUpdate, makeDetails("chain"), _toolCallId, emitSubagentToolProgress, ext, ctx);
                     results.push(result);
                     const isError = result.exitCode !== 0 ||
                         result.stopReason === "error" ||
@@ -591,7 +710,7 @@ export default function subagentExtension(ext, opts) {
                             allResults[index] = partial.details.results[0];
                             emitParallelUpdate();
                         }
-                    }, makeDetails("parallel"), ext, ctx);
+                    }, makeDetails("parallel"), _toolCallId, emitSubagentToolProgress, ext, ctx);
                     allResults[index] = result;
                     emitParallelUpdate();
                     return result;
@@ -614,7 +733,7 @@ export default function subagentExtension(ext, opts) {
             }
             // ── Single mode ─────────────────────────────────────────────
             if (params.agent && params.task) {
-                const result = await runSingleAgent(ctx.cwd, agents, params.agent, params.task, params.cwd, undefined, signal, onUpdate, makeDetails("single"), ext, ctx);
+                const result = await runSingleAgent(ctx.cwd, agents, params.agent, params.task, params.cwd, undefined, signal, onUpdate, makeDetails("single"), _toolCallId, emitSubagentToolProgress, ext, ctx);
                 const isError = result.exitCode !== 0 ||
                     result.stopReason === "error" ||
                     result.stopReason === "aborted";

package/dist/commands/login.d.ts

@@ -9,6 +9,7 @@
  *   2b. OAuth: open browser for Aexol Studio authorization.
  *   3. Verify reachability + auth by calling tools/list against the URL.
  *   4. On success: persist to ~/.spectral/config.json (mode 0600).
+ *   5. Chain OAuth to also obtain a user JWT for Kanban/Studio features.
  *
  * Exits non-zero on any failure so shell scripts can detect it.
  *

package/dist/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAgBH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAqCzF;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAyE9C"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAiBH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAqCzF;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAqF9C"}

package/dist/commands/login.js

@@ -9,6 +9,7 @@
  *   2b. OAuth: open browser for Aexol Studio authorization.
  *   3. Verify reachability + auth by calling tools/list against the URL.
  *   4. On success: persist to ~/.spectral/config.json (mode 0600).
+ *   5. Chain OAuth to also obtain a user JWT for Kanban/Studio features.
  *
  * Exits non-zero on any failure so shell scripts can detect it.
  *
@@ -20,6 +21,7 @@ import { password, select } from "@inquirer/prompts";
 import pc from "picocolors";
 import { TEAM_API_KEY_PREFIX, getApiUrl, getConfigFile, validateTeamApiKey, writeConfig, } from "../config.js";
 import { AexolMcpClient, AexolMcpError } from "../mcp-client.js";
+import { runOAuthFlow } from "../auth-helper.js";
 /**
  * Pure login logic. Throws `Error` with one of these stable message prefixes:
  *   - "Invalid API key prefix"  — local validation failed
@@ -126,4 +128,14 @@ export async function runLogin() {
     }
     process.stdout.write(pc.green(`✓ Authenticated. Found ${result.toolCount} tools.\n`));
     process.stdout.write(pc.dim(`Saved credentials to ${getConfigFile()}\n`));
+    // Chain OAuth for Kanban/Studio features (non-fatal — MCP tools work without it)
+    process.stdout.write(pc.dim("\nAuthorizing for Aexol Studio features (Kanban)...\n"));
+    const oauthResult = await runOAuthFlow(apiUrl);
+    if (oauthResult.ok) {
+        process.stdout.write(pc.green("✓ CLI authorized for Studio/Kanban.\n"));
+    }
+    else {
+        process.stderr.write(pc.yellow(`⚠ OAuth authorization skipped (${oauthResult.reason}). Kanban/Studio features may not be available.\n`));
+        process.stderr.write(pc.dim("  Run `spectral login` and choose OAuth to set it up later.\n"));
+    }
 }

package/dist/extensions/aexol-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aexol-mcp.d.ts","sourceRoot":"","sources":["../../src/extensions/aexol-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAoC,MAAM,8BAA8B,CAAC;AAsKnG,wBAA8B,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAuShF"}
+{"version":3,"file":"aexol-mcp.d.ts","sourceRoot":"","sources":["../../src/extensions/aexol-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAoC,MAAM,8BAA8B,CAAC;AAiKnG,wBAA8B,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAsShF"}

package/dist/extensions/aexol-mcp.js

@@ -80,22 +80,16 @@ function toLabel(name) {
 // ---------------------------------------------------------------------------
 // Studio binding – in-memory cache, refreshed on startup & by local tools
 // ---------------------------------------------------------------------------
-let currentBinding = null;
-let sessionCwd = null;
-let bindingMtimeMs = null;
+/** Per-cwd binding cache — eliminates races when multiple sessions share a process. */
+const bindingCache = new Map();
 /**
- * Re-read the Studio binding file when it changes on disk so that runtime
- * binding changes (e.g. via the /agent UI bind/unbind, or an external edit)
- * propagate to running agent sessions without requiring a CLI restart or a
- * new conversation. The AgentBridge's reloadProjectBindings() refreshes model
- * proxy routing, but the aexol-mcp extension's currentBinding is only read at
- * session_start otherwise. mtime caching keeps the common case (no change) at
- * a single cheap stat() per remote_* call.
+ * Per-cwd binding reader. Reads `.aexol/aexol.jsonc` under the given
+ * working directory with mtime caching. The cache key is the cwd itself,
+ * so concurrent sessions serving different projects never interfere.
  */
-async function refreshBindingFromDisk() {
-    if (!sessionCwd)
-        return;
-    const bindingFile = join(sessionCwd, ".aexol", "aexol.jsonc");
+async function refreshBindingForCwd(cwd) {
+    const bindingFile = join(cwd, ".aexol", "aexol.jsonc");
+    const cached = bindingCache.get(cwd);
     let mtimeMs;
     try {
         mtimeMs = (await stat(bindingFile)).mtimeMs;
@@ -103,24 +97,23 @@ async function refreshBindingFromDisk() {
     catch (err) {
         const code = err.code;
         if (code === "ENOENT" || code === "ENOTDIR") {
-            if (currentBinding !== null) {
-                currentBinding = null;
-                bindingMtimeMs = null;
-            }
-            return;
+            bindingCache.set(cwd, { binding: null, mtimeMs: null });
+            return null;
         }
         // Non-fatal: keep the last known binding.
-        return;
+        return cached?.binding ?? null;
     }
-    if (mtimeMs === bindingMtimeMs)
-        return;
+    if (cached && mtimeMs === cached.mtimeMs)
+        return cached.binding;
     try {
-        currentBinding = await readStudioBinding(sessionCwd);
-        bindingMtimeMs = mtimeMs;
+        const binding = await readStudioBinding(cwd);
+        bindingCache.set(cwd, { binding, mtimeMs });
+        return binding;
     }
     catch {
         // Parse error etc. — keep last known binding, force re-read next time.
-        bindingMtimeMs = null;
+        bindingCache.set(cwd, { binding: cached?.binding ?? null, mtimeMs: null });
+        return cached?.binding ?? null;
     }
 }
 /**
@@ -141,15 +134,15 @@ const MODEL_INJECTING_TOOLS = new Set([
 ]);
 const SPECTRAL_PROXY_USER_MODEL = "spectral-proxy-user-model";
 const BUILT_IN_PREFIX = "built-in/";
-function augmentParams(toolName, params, ctx) {
+function augmentParams(toolName, params, ctx, binding) {
     if (!toolName.startsWith("remote_"))
         return { params };
     const augmented = { ...params };
-    if (currentBinding?.teamId && !("teamId" in params)) {
-        augmented.teamId = currentBinding.teamId;
+    if (binding?.teamId && !("teamId" in params)) {
+        augmented.teamId = binding.teamId;
     }
-    if (currentBinding?.projectId && !("projectId" in params)) {
-        augmented.projectId = currentBinding.projectId;
+    if (binding?.projectId && !("projectId" in params)) {
+        augmented.projectId = binding.projectId;
     }
     if (MODEL_INJECTING_TOOLS.has(toolName)) {
         const model = ctx.model;
@@ -185,13 +178,12 @@ export default async function aexolMcpExtension(ext) {
     const client = new AexolMcpClient(apiUrl, token);
     // ---- Load local Studio binding on session start --------------------------
     ext.on("session_start", async (_event, ctx) => {
-        sessionCwd = ctx.cwd;
         try {
-            await refreshBindingFromDisk();
-            if (currentBinding) {
-                const displayName = currentBinding.name ?? currentBinding.projectId;
-                process.stderr.write(`[aexol-mcp] Studio binding found: ${displayName} (${currentBinding.projectId})` +
-                    (currentBinding.teamId ? `, team ${currentBinding.teamId}` : "") +
+            const binding = await refreshBindingForCwd(ctx.cwd);
+            if (binding) {
+                const displayName = binding.name ?? binding.projectId;
+                process.stderr.write(`[aexol-mcp] Studio binding found: ${displayName} (${binding.projectId})` +
+                    (binding.teamId ? `, team ${binding.teamId}` : "") +
                     `\n`);
             }
         }
@@ -253,8 +245,8 @@ export default async function aexolMcpExtension(ext) {
             description: tool.description ?? "",
             parameters,
             async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
-                await refreshBindingFromDisk();
-                const augmented = augmentParams(tool.name, params, ctx);
+                const binding = await refreshBindingForCwd(ctx.cwd);
+                const augmented = augmentParams(tool.name, params, ctx, binding);
                 if ("error" in augmented) {
                     return {
                         content: [{ type: "text", text: augmented.error }],
@@ -335,10 +327,8 @@ export default async function aexolMcpExtension(ext) {
                 };
                 try {
                     await writeStudioBinding(binding, ctx.cwd);
-                    if (!sessionCwd)
-                        sessionCwd = ctx.cwd;
-                    currentBinding = binding;
-                    bindingMtimeMs = null;
+                    // Invalidate the per-cwd cache so the next refreshBindingForCwd re-reads.
+                    bindingCache.set(ctx.cwd, { binding, mtimeMs: null });
                     const displayName = binding.name ?? binding.projectId;
                     return {
                         content: [{
@@ -377,20 +367,19 @@ export default async function aexolMcpExtension(ext) {
                 properties: {},
             },
             async execute(_toolCallId, _params, _signal, _onUpdate, ctx) {
-                if (!currentBinding) {
+                const binding = await refreshBindingForCwd(ctx.cwd);
+                if (!binding) {
                     return {
                         content: [{ type: "text", text: "No Studio binding found in this directory — nothing to unbind." }],
                         details: { isError: false },
                     };
                 }
-                const displayName = currentBinding.name ?? currentBinding.projectId;
-                const projectId = currentBinding.projectId;
+                const displayName = binding.name ?? binding.projectId;
+                const projectId = binding.projectId;
                 try {
                     const deleted = await deleteStudioBinding(ctx.cwd);
-                    if (!sessionCwd)
-                        sessionCwd = ctx.cwd;
-                    currentBinding = null;
-                    bindingMtimeMs = null;
+                    // Invalidate the per-cwd cache.
+                    bindingCache.set(ctx.cwd, { binding: null, mtimeMs: null });
                     if (deleted) {
                         return {
                             content: [{
@@ -430,8 +419,9 @@ export default async function aexolMcpExtension(ext) {
                 type: "object",
                 properties: {},
             },
-            async execute() {
-                if (!currentBinding) {
+            async execute(_toolCallId, _params, _signal, _onUpdate, ctx) {
+                const binding = await refreshBindingForCwd(ctx.cwd);
+                if (!binding) {
                     return {
                         content: [{
                                 type: "text",
@@ -444,7 +434,7 @@ export default async function aexolMcpExtension(ext) {
                 return {
                     content: [{
                             type: "text",
-                            text: JSON.stringify(currentBinding, null, 2),
+                            text: JSON.stringify(binding, null, 2),
                         }],
                     details: { isError: false },
                 };

package/dist/extensions/kanban-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kanban-bridge.d.ts","sourceRoot":"","sources":["../../src/extensions/kanban-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAoC,MAAM,8BAA8B,CAAC;AA41BnG,wBAA8B,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCpF"}
+{"version":3,"file":"kanban-bridge.d.ts","sourceRoot":"","sources":["../../src/extensions/kanban-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAoC,MAAM,8BAA8B,CAAC;AA09BnG,wBAA8B,qBAAqB,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCpF"}