@aiguru/google-web-operations 0.6.4

package/sites/secrets.example.yaml

@@ -0,0 +1,6 @@
+# Copy to sites/<host>.secrets.yaml next to sites/<host>.yaml. Gitignored.
+# Merged into the site record at load time and stripped from every public view.
+
+odoo:
+  login: gwo-api          # dedicated API user, Website > Restricted Editor is enough
+  api_key: "paste-the-api-key-here"

package/tools/build-hosts.js

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+/**
+ * Generate hosts/claude and hosts/codex from packages/playbooks.
+ *
+ * Never edit hosts/ by hand. CI fails if hosts/ differs from what this
+ * script produces, so nothing here may depend on the machine it runs on:
+ * absolute paths are placeholders that tools/install.ts resolves.
+ *
+ * Claude Code: a plugin directory with .claude-plugin/plugin.json, .mcp.json,
+ *              skills/<name>/SKILL.md and commands/<name>.md.
+ * Codex:       a plugin directory with .codex-plugin/plugin.json and the same
+ *              skills/<name>/SKILL.md (Codex reads the same SKILL.md format),
+ *              plus AGENTS.md (all playbooks, for projects that only take
+ *              instructions) and a config.toml template for the MCP server.
+ */
+import { mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { HOSTS_DIR, PLAYBOOKS_DIR, ROOT } from "../packages/core/src/paths.js";
+const pkg = JSON.parse(readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+const CLAUDE = path.join(HOSTS_DIR, 'claude');
+const CODEX = path.join(HOSTS_DIR, 'codex');
+const HEADER = '<!-- GENERATED by tools/build-hosts.ts from packages/playbooks. Do not edit here. -->\n\n';
+/** Placeholders resolved per machine by tools/install.ts (gwo install). */
+export const PLACEHOLDER = { server: '__GWO_SERVER__', node: '__NODE__' };
+function readPlaybooks() {
+    return readdirSync(PLAYBOOKS_DIR).filter((f) => f.endsWith('.md')).sort().map((file) => {
+        const raw = readFileSync(path.join(PLAYBOOKS_DIR, file), 'utf8');
+        const m = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+        if (!m)
+            throw new Error(`${file}: missing frontmatter`);
+        const fm = Object.fromEntries((m[1] ?? '').split('\n').map((l) => {
+            const i = l.indexOf(':');
+            return [l.slice(0, i).trim(), l.slice(i + 1).trim()];
+        }));
+        const name = fm['name'], description = fm['description'];
+        if (!name || !description)
+            throw new Error(`${file}: frontmatter needs name and description`);
+        return { file, name, description, body: (m[2] ?? '').trim(), frontmatter: m[1] ?? '' };
+    });
+}
+function write(p, s) { mkdirSync(path.dirname(p), { recursive: true }); writeFileSync(p, s); }
+/** One SKILL.md per playbook. Identical for both hosts; the format is shared. */
+function writeSkills(dir, playbooks) {
+    for (const p of playbooks) {
+        write(path.join(dir, 'skills', p.name, 'SKILL.md'), `---\n${p.frontmatter}\n---\n\n${HEADER}${p.body}\n`);
+    }
+}
+const COMMANDS = {
+    'gwo-daily': 'Run the daily health pass. Load skills gwo-operating-model and gwo-daily, then execute for every enabled site, or only the site named in $ARGUMENTS.',
+    'gwo-weekly': 'Run the weekly improvement pass. Load gwo-operating-model and gwo-weekly, then execute for every enabled site, or only $ARGUMENTS.',
+    'gwo-monthly': 'Run the monthly deep scan and produce both reports. Load gwo-operating-model, gwo-monthly and gwo-client-report-template. Site: $ARGUMENTS or all.',
+    'gwo-triage': 'Triage an incident for the site in $ARGUMENTS. Load gwo-operating-model and gwo-triage. Find the cause before proposing any fix.',
+    'gwo-onboard': 'Onboard the site in $ARGUMENTS. Load gwo-operating-model and gwo-onboarding.',
+    'gwo-scan': 'Run web_scan_site for the site in $ARGUMENTS and summarise the findings in the operator tone from gwo-operating-model.',
+    'gwo-setup': 'Set up or administer the system from the chat. Load gwo-setup, call ops_setup_status, and walk the operator through the next step: $ARGUMENTS.',
+    'gwo-add-site': 'Register the site in $ARGUMENTS. Load gwo-setup and gwo-onboarding; ask only for what cannot be inferred, then ops_add_site, baseline scan, and the access checklist for the client.',
+    'gwo-measure': 'Audit measurement for the site in $ARGUMENTS. Load gwo-operating-model and gwo-measurement, run the audit, and propose staged Tag Manager changes with their tokens.',
+};
+// ------------------------------------------------------------------ Claude Code
+function buildClaude(playbooks) {
+    rmSync(CLAUDE, { recursive: true, force: true });
+    write(path.join(CLAUDE, '.claude-plugin', 'plugin.json'), JSON.stringify({
+        name: 'google-web-operations', version: pkg.version, description: pkg.description,
+        author: { name: 'AI Guru' }, mcpServers: './.mcp.json',
+    }, null, 2) + '\n');
+    // Runs the server with node directly: no npm, no tsx, no build step.
+    write(path.join(CLAUDE, '.mcp.json'), JSON.stringify({ mcpServers: { 'google-web-operations': {
+                command: 'node', args: ['${CLAUDE_PLUGIN_ROOT}/../../apps/mcp-server/src/index.ts'],
+            } } }, null, 2) + '\n');
+    writeSkills(CLAUDE, playbooks);
+    for (const [name, body] of Object.entries(COMMANDS)) {
+        write(path.join(CLAUDE, 'commands', `${name}.md`), `---\ndescription: ${body.split('.')[0]}.\n---\n\n${HEADER}${body}\n`);
+    }
+    write(path.join(CLAUDE, 'README.md'), HEADER + '# Google Web Operations for Claude Code\n\n' +
+        'Install with `gwo install claude` (user-scope MCP server, skills and commands), or load this directory as a plugin.\n\n' +
+        `Commands: ${Object.keys(COMMANDS).map((c) => '/' + c).join(', ')}.\n`);
+}
+// ------------------------------------------------------------------ Codex
+function buildCodex(playbooks) {
+    rmSync(CODEX, { recursive: true, force: true });
+    // A valid Codex plugin directory: manifest + skills. Installable from a local marketplace.
+    write(path.join(CODEX, '.codex-plugin', 'plugin.json'), JSON.stringify({
+        name: 'google-web-operations', version: pkg.version, description: pkg.description,
+        author: { name: 'AI Guru' }, homepage: 'https://github.com/ai-gur/GWeb-Ops', license: 'Proprietary',
+        keywords: ['seo', 'geo', 'search console', 'analytics', 'tag manager', 'website operations'],
+        skills: './skills/',
+        interface: {
+            displayName: 'Google Web Operations', shortDescription: 'Operate client websites in search and AI answer engines',
+            longDescription: 'Scans sites, reads Search Console, GA4, Tag Manager and PageSpeed, applies policy-gated and verified fixes, and runs daily, weekly and monthly playbooks.',
+            developerName: 'AI Guru', category: 'Productivity', capabilities: ['Read', 'Write'],
+        },
+    }, null, 2) + '\n');
+    writeSkills(CODEX, playbooks);
+    // Instructions file for projects that take AGENTS.md rather than skills.
+    const agents = [HEADER, '# Google Web Operations\n',
+        '\nThe `google-web-operations` MCP server is the source of truth for site state. The sections below are the operating playbooks; load the matching one before a run.\n'];
+    for (const p of playbooks)
+        agents.push(`\n\n<!-- ${p.file} -->\n\n${p.body}\n`);
+    write(path.join(CODEX, 'AGENTS.md'), agents.join(''));
+    // MCP server entry. Codex config cannot expand variables and the existing
+    // entries on operator machines use absolute executables, so both the node
+    // binary and the repository root are placeholders resolved at install time.
+    write(path.join(CODEX, '.codex', 'config.template.toml'), `# Generated template. "gwo install codex" resolves ${PLACEHOLDER.node} and ${PLACEHOLDER.server} and writes this into ~/.codex/config.toml.\n` +
+        '[mcp_servers.google-web-operations]\n' +
+        `command = '${PLACEHOLDER.node}'\n` +
+        `args = ['${PLACEHOLDER.server}']\n` +
+        'startup_timeout_sec = 60\n');
+    write(path.join(CODEX, 'README.md'), HEADER + '# Google Web Operations for Codex\n\n' +
+        'This directory is a Codex plugin (`.codex-plugin/plugin.json` + `skills/`). Install everything with:\n\n' +
+        '```\ngwo install codex\n```\n\n' +
+        'That writes the MCP server into `~/.codex/config.toml` (absolute paths resolved for this machine) and copies the ' +
+        'skills into `~/.codex/skills/`. `gwo install codex --print` only shows what it would do.\n\n' +
+        'For a project that takes instructions rather than skills, place `AGENTS.md` where Codex runs.\n');
+}
+const playbooks = readPlaybooks();
+buildClaude(playbooks);
+buildCodex(playbooks);
+console.log(`hosts/claude: ${playbooks.length} skills, ${Object.keys(COMMANDS).length} commands. hosts/codex: plugin manifest, ${playbooks.length} skills, AGENTS.md, config template.`);

package/tools/build-package.js

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+/**
+ * Build the distributable package under build/.
+ *
+ * Development runs TypeScript natively (ADR-004), but Node refuses to strip
+ * types for anything under node_modules, so the package people install
+ * globally must ship JavaScript. This script:
+ *   1. compiles apps/, packages/ and tools/ to build/ with .ts imports
+ *      rewritten to .js (tsc, rewriteRelativeImportExtensions);
+ *   2. copies the non-code parts the code resolves from its root: policies,
+ *      hosts, playbooks, site templates, .env.example, docs, the scheduler,
+ *      the bin;
+ *   3. writes a package.json without dev-only fields.
+ * `npm pack` inside build/ then produces the tarball (npm run pack:release).
+ */
+import { execFileSync } from 'node:child_process';
+import { cpSync, mkdirSync, readFileSync, rmSync, writeFileSync, existsSync } from 'node:fs';
+import path from 'node:path';
+import { ROOT } from "../packages/core/src/paths.js";
+const OUT = path.join(ROOT, 'build');
+rmSync(OUT, { recursive: true, force: true });
+mkdirSync(OUT, { recursive: true });
+// 1. Compile.
+const tsc = path.join(ROOT, 'node_modules', 'typescript', 'bin', 'tsc');
+execFileSync(process.execPath, [tsc, '-p', path.join(ROOT, 'tsconfig.build.json')], { stdio: 'inherit' });
+// 2. Static parts, at the same relative paths the code expects under its root.
+const copy = (rel) => { if (existsSync(path.join(ROOT, rel)))
+    cpSync(path.join(ROOT, rel), path.join(OUT, rel), { recursive: true }); };
+for (const rel of ['policies', 'hosts', 'bin', 'docs', 'README.md', '.env.example', path.join('tools', 'schedule.ps1'), path.join('sites', 'schema.yaml'), path.join('sites', 'secrets.example.yaml')])
+    copy(rel);
+for (const f of ['00-operating-model.md'])
+    void f; // playbooks are copied whole below
+cpSync(path.join(ROOT, 'packages', 'playbooks'), path.join(OUT, 'packages', 'playbooks'), { recursive: true, filter: (src) => !src.endsWith('.ts') });
+// 3. package.json for the tarball: runtime fields only.
+const pkg = JSON.parse(readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+const out = {
+    name: pkg['name'], version: pkg['version'], description: pkg['description'], license: pkg['license'] ?? 'UNLICENSED', private: false,
+    type: 'module', engines: pkg['engines'], repository: pkg['repository'],
+    bin: { gwo: 'bin/gwo.js' },
+    dependencies: pkg['dependencies'],
+};
+writeFileSync(path.join(OUT, 'package.json'), JSON.stringify(out, null, 2) + '\n');
+console.log(`build/: ${pkg['name']}@${pkg['version']} (JavaScript, ready for npm pack)`);

package/tools/install.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+/**
+ * Install or remove the hosts' side of Google Web Operations on this machine.
+ *
+ *   gwo install [claude|codex|all] [--print]
+ *   gwo uninstall [claude|codex|all]
+ *
+ * Claude Code: the MCP server goes into ~/.claude.json (user scope), skills
+ *              into ~/.claude/skills/gwo-*, slash commands into
+ *              ~/.claude/commands/gwo-*.md.
+ * Codex:       the MCP server goes into ~/.codex/config.toml, skills into
+ *              ~/.codex/skills/gwo-*.
+ * Both:        the operator state directory (GWO_HOME, default ~/.gwo) is
+ *              created with .env, sites/schema.yaml and secrets.example.yaml
+ *              so the first ops_setup_status has something to point at.
+ *
+ * Only gwo-* entries are ever written or removed; nothing else in those
+ * directories or files is touched. Idempotent: run it again after an upgrade.
+ */
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, copyFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { HOME_DIR, HOSTS_DIR, IS_CHECKOUT, ROOT } from "../packages/core/src/paths.js";
+const argv = process.argv.slice(2);
+const uninstall = argv.includes('uninstall');
+const targetArg = argv.find((a) => ['claude', 'codex', 'all'].includes(a)) ?? 'all';
+const print = argv.includes('--print') || argv.includes('--dry-run');
+const targets = targetArg === 'all' ? ['claude', 'codex'] : [targetArg];
+const SERVER = 'google-web-operations';
+const toPosix = (p) => p.replace(/\\/g, '/');
+const node = process.execPath;
+// A checkout runs TypeScript; the packaged build is JavaScript.
+const server = ['index.js', 'index.ts'].map((f) => path.join(ROOT, 'apps', 'mcp-server', 'src', f)).find((f) => existsSync(f));
+const CLAUDE_HOME = process.env['CLAUDE_CONFIG_DIR']?.trim() || path.join(homedir(), '.claude');
+const CODEX_HOME = process.env['CODEX_HOME']?.trim() || path.join(homedir(), '.codex');
+const log = (s) => console.log(s);
+const gwoDirs = (dir) => (existsSync(dir) ? readdirSync(dir).filter((n) => n.startsWith('gwo-')) : []);
+// ---------------------------------------------------------------- operator home
+function ensureHome() {
+    if (IS_CHECKOUT) {
+        log(`state: repository checkout ${HOME_DIR}`);
+        return;
+    }
+    log(`state: ${HOME_DIR}${existsSync(HOME_DIR) ? '' : ' (will be created)'}`);
+    if (print)
+        return;
+    for (const d of ['sites', 'secrets', '.gwo-data'])
+        mkdirSync(path.join(HOME_DIR, d), { recursive: true });
+    const seed = (from, to) => { if (!existsSync(to) && existsSync(from))
+        copyFileSync(from, to); };
+    seed(path.join(ROOT, '.env.example'), path.join(HOME_DIR, '.env'));
+    seed(path.join(ROOT, 'sites', 'schema.yaml'), path.join(HOME_DIR, 'sites', 'schema.yaml'));
+    seed(path.join(ROOT, 'sites', 'secrets.example.yaml'), path.join(HOME_DIR, 'sites', 'secrets.example.yaml'));
+}
+// ---------------------------------------------------------------- Claude Code
+function claude() {
+    const cfg = path.join(homedir(), '.claude.json');
+    const skillsSrc = path.join(HOSTS_DIR, 'claude', 'skills'), cmdSrc = path.join(HOSTS_DIR, 'claude', 'commands');
+    const skillsDst = path.join(CLAUDE_HOME, 'skills'), cmdDst = path.join(CLAUDE_HOME, 'commands');
+    const skills = gwoDirs(skillsSrc), commands = readdirSync(cmdSrc).filter((n) => n.startsWith('gwo-'));
+    log(`\nClaude Code`);
+    log(`  MCP server "${SERVER}" ${uninstall ? 'removed from' : 'in'} ${cfg} (user scope)`);
+    log(`  ${skills.length} skills -> ${skillsDst}, ${commands.length} commands -> ${cmdDst}`);
+    if (print)
+        return;
+    let json = {};
+    if (existsSync(cfg))
+        json = JSON.parse(readFileSync(cfg, 'utf8'));
+    const servers = (json['mcpServers'] ?? {});
+    if (uninstall)
+        delete servers[SERVER];
+    else
+        servers[SERVER] = { type: 'stdio', command: node, args: [server], env: {} };
+    json['mcpServers'] = servers;
+    writeFileSync(cfg, JSON.stringify(json, null, 2));
+    for (const n of gwoDirs(skillsDst))
+        rmSync(path.join(skillsDst, n), { recursive: true, force: true });
+    for (const n of (existsSync(cmdDst) ? readdirSync(cmdDst).filter((x) => x.startsWith('gwo-')) : []))
+        rmSync(path.join(cmdDst, n), { force: true });
+    if (!uninstall) {
+        mkdirSync(skillsDst, { recursive: true });
+        mkdirSync(cmdDst, { recursive: true });
+        for (const n of skills)
+            cpSync(path.join(skillsSrc, n), path.join(skillsDst, n), { recursive: true });
+        for (const n of commands)
+            copyFileSync(path.join(cmdSrc, n), path.join(cmdDst, n));
+    }
+}
+// ---------------------------------------------------------------- Codex
+function codex() {
+    const cfg = path.join(CODEX_HOME, 'config.toml');
+    const skillsSrc = path.join(HOSTS_DIR, 'codex', 'skills'), skillsDst = path.join(CODEX_HOME, 'skills');
+    const skills = gwoDirs(skillsSrc);
+    const template = readFileSync(path.join(HOSTS_DIR, 'codex', '.codex', 'config.template.toml'), 'utf8')
+        .replace(/^# Generated template.*\n/m, '').replaceAll('__GWO_SERVER__', toPosix(server)).replaceAll('__NODE__', toPosix(node)).trim();
+    log(`\nCodex`);
+    log(`  MCP server "${SERVER}" ${uninstall ? 'removed from' : 'in'} ${cfg}`);
+    log(`  ${skills.length} skills -> ${skillsDst}`);
+    if (print) {
+        log(template.split('\n').map((l) => '    ' + l).join('\n'));
+        return;
+    }
+    mkdirSync(CODEX_HOME, { recursive: true });
+    let toml = existsSync(cfg) ? readFileSync(cfg, 'utf8') : '';
+    // Replace our block wholesale (from its header to the next table header or EOF), so upgrades change paths in place.
+    const block = new RegExp(`\\n?\\[mcp_servers\\.${SERVER.replace(/-/g, '\\-')}\\][\\s\\S]*?(?=\\n\\[|$)`);
+    toml = toml.replace(block, '');
+    if (!uninstall)
+        toml = toml.replace(/\s*$/, '\n') + '\n' + template + '\n';
+    writeFileSync(cfg, toml);
+    for (const n of gwoDirs(skillsDst))
+        rmSync(path.join(skillsDst, n), { recursive: true, force: true });
+    if (!uninstall) {
+        mkdirSync(skillsDst, { recursive: true });
+        for (const n of skills)
+            cpSync(path.join(skillsSrc, n), path.join(skillsDst, n), { recursive: true });
+    }
+}
+log(`Google Web Operations ${uninstall ? 'uninstall' : 'install'}${print ? ' (print only)' : ''}`);
+log(`package: ${ROOT}`);
+log(`node:    ${node}`);
+if (!uninstall)
+    ensureHome();
+if (targets.includes('claude'))
+    claude();
+if (targets.includes('codex'))
+    codex();
+if (print)
+    log('\nNothing changed. Run without --print to apply.');
+else if (uninstall)
+    log('\nDone. Restart Claude Code and Codex. Your sites, data and secrets were left in place.');
+else
+    log([
+        '',
+        'Done.',
+        '',
+        'Next',
+        '  1. Restart Claude Code and Codex so they pick up the server and skills.',
+        '  2. Claude Code: type /gwo-setup.   Codex: say "set up Google Web Operations".',
+        '     The assistant connects Google, registers the first site and tells you what the client must grant.',
+        '  3. Any time: gwo doctor   (what is configured, what is missing, the next step)',
+        '',
+        `State lives in ${HOME_DIR}: sites/, .gwo-data/, secrets/, .env. Upgrades never touch it.`,
+        'Docs: docs/INSTALL.he.md, docs/GETTING-STARTED.he.md (עברית), README.md.',
+    ].join('\n'));

package/tools/schedule.ps1

@@ -0,0 +1,37 @@
+# Register (or remove) Windows Task Scheduler jobs that run the worker.
+#   powershell -ExecutionPolicy Bypass -File tools\schedule.ps1 install
+#   powershell -ExecutionPolicy Bypass -File tools\schedule.ps1 remove
+#   powershell -ExecutionPolicy Bypass -File tools\schedule.ps1 status
+#
+# Runs as the current user (the OAuth token is DPAPI-bound to this user), only
+# when the machine is on, and catches up a missed run at next start.
+param([ValidateSet('install','remove','status')][string]$Action = 'status')
+
+$root = Split-Path -Parent $PSScriptRoot
+$node = (Get-Command node).Source
+$worker = Join-Path $root 'apps\worker\src\index.js'   # packaged build
+if (-not (Test-Path $worker)) { $worker = Join-Path $root 'apps\worker\src\index.ts' }   # repository checkout
+$jobs = @(
+  @{ Name = 'GWebOps Daily';  Args = "daily --deliver";  Trigger = (New-ScheduledTaskTrigger -Daily -At 07:00) },
+  @{ Name = 'GWebOps Weekly'; Args = "weekly --deliver"; Trigger = (New-ScheduledTaskTrigger -Weekly -DaysOfWeek Monday -At 07:30) }
+)
+
+switch ($Action) {
+  'install' {
+    foreach ($j in $jobs) {
+      $taskAction = New-ScheduledTaskAction -Execute $node -Argument "`"$worker`" $($j.Args)" -WorkingDirectory $root
+      $settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Hours 1) -MultipleInstances IgnoreNew
+      Register-ScheduledTask -TaskName $j.Name -Action $taskAction -Trigger $j.Trigger -Settings $settings -Description 'Google Web Operations scheduled sensing run' -Force | Out-Null
+      Write-Output "registered: $($j.Name)"
+    }
+  }
+  'remove' {
+    foreach ($j in $jobs) { Unregister-ScheduledTask -TaskName $j.Name -Confirm:$false -ErrorAction SilentlyContinue; Write-Output "removed: $($j.Name)" }
+  }
+  'status' {
+    Get-ScheduledTask -TaskName 'GWebOps *' -ErrorAction SilentlyContinue | ForEach-Object {
+      $i = $_ | Get-ScheduledTaskInfo
+      "{0,-16} state={1,-8} last={2}  result={3}  next={4}" -f $_.TaskName, $_.State, $i.LastRunTime, $i.LastTaskResult, $i.NextRunTime
+    }
+  }
+}

package/tools/smoke-mcp.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+/**
+ * Smoke test: start the MCP server over stdio, initialise, list tools,
+ * call a registry tool and two policy checks. Exits non-zero on failure.
+ */
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { ROOT } from "../packages/core/src/paths.js";
+const server = path.join(ROOT, 'apps', 'mcp-server', 'src', 'index.ts');
+const child = spawn(process.execPath, [server], { stdio: ['pipe', 'pipe', 'inherit'] });
+const pending = new Map();
+let buf = '';
+child.stdout.on('data', (d) => {
+    buf += d.toString();
+    let i;
+    while ((i = buf.indexOf('\n')) >= 0) {
+        const line = buf.slice(0, i).trim();
+        buf = buf.slice(i + 1);
+        if (!line)
+            continue;
+        try {
+            const m = JSON.parse(line);
+            if (m.id !== undefined && pending.has(m.id)) {
+                pending.get(m.id)(m);
+                pending.delete(m.id);
+            }
+        }
+        catch { /* not json */ }
+    }
+});
+let nextId = 1;
+const call = (method, params = {}) => new Promise((res) => {
+    const id = nextId++;
+    pending.set(id, res);
+    child.stdin.write(JSON.stringify({ jsonrpc: '2.0', id, method, params }) + '\n');
+});
+const notify = (method) => child.stdin.write(JSON.stringify({ jsonrpc: '2.0', method, params: {} }) + '\n');
+const first = (m) => (m.result?.content?.[0]?.text ?? '').replace(/\s+/g, ' ').slice(0, 220);
+const timer = setTimeout(() => { console.error('smoke: timeout'); child.kill(); process.exit(1); }, 20_000);
+try {
+    const init = await call('initialize', { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'smoke', version: '0' } });
+    console.log('server:', JSON.stringify(init.result?.serverInfo));
+    notify('notifications/initialized');
+    const tools = await call('tools/list');
+    const names = (tools.result?.tools ?? []).map((t) => t.name);
+    console.log(`tools (${names.length}):`, names.join(', '));
+    if (names.length < 10)
+        throw new Error('expected at least 10 tools');
+    console.log('ops_list_sites ->', first(await call('tools/call', { name: 'ops_list_sites', arguments: {} })));
+    console.log('classify gtm.publish ->', first(await call('tools/call', { name: 'ops_classify_action', arguments: { action: 'gtm.publish', site: 'aiguru' } })));
+    console.log('classify google.property.delete ->', first(await call('tools/call', { name: 'ops_classify_action', arguments: { action: 'google.property.delete' } })));
+    console.log('smoke: OK');
+}
+catch (e) {
+    console.error('smoke: FAIL', e.message);
+    process.exitCode = 1;
+}
+finally {
+    clearTimeout(timer);
+    child.kill();
+}