@akira-tl/forgerelay 1.1.2 → 1.2.0

package/dist/mcp/hooks/hook-cli.js

@@ -1,16 +1,14 @@
-import { resolve } from "node:path";
-import { HOOK_EVENTS, loadProjectHookConfig, mergeHookConfigs, parseHookConfig, } from "./hooks.js";
-import { loadForgeRelayFiles } from "../../runtime/config/user-config.js";
-export async function checkHookConfiguration(projectRoot, globalHooks = loadGlobalHooks()) {
-    const globalEntries = flattenHooks(globalHooks, "global");
-    const project = await loadProjectHookConfig(projectRoot);
-    if (project.diagnostic) {
-        throw new Error(`Hook check failed: ${project.diagnostic}`);
-    }
-    const projectEntries = flattenHooks(project.hooks, "project");
+import { join, resolve } from "node:path";
+import { resolveProjectContext } from "../../workspaces/state/project-context.js";
+import { effectiveHookConfigEntries, resolveHooksConfig, } from "../../runtime/config/resolution/hooks.js";
+import { forgerelayConfigDir } from "../../runtime/config/user-config.js";
+export async function checkHookConfiguration(projectRoot, globalHooks = {}, configDir, sourceRuntime) {
+    const resolution = await resolveHookConfiguration(projectRoot, globalHooks, configDir, sourceRuntime);
+    assertHookResolutionValid(resolution);
+    const entries = flattenResolvedHooks(resolution);
     return {
-        globalHooks: globalEntries.length,
-        projectHooks: projectEntries.length,
+        globalHooks: entries.filter((entry) => entry.scope === "global").length,
+        projectHooks: entries.filter((entry) => entry.scope === "project").length,
     };
 }
 export async function runHooksCommand(args) {
@@ -20,42 +18,75 @@ export async function runHooksCommand(args) {
         return;
     }
     const projectRoot = parseProjectRoot(rest);
-    const globalHooks = loadGlobalHooks();
-    const project = await loadProjectHookConfig(projectRoot);
-    const globalEntries = flattenHooks(globalHooks, "global");
-    const projectEntries = flattenHooks(project.hooks, "project");
+    const configDir = forgerelayConfigDir();
+    const resolution = await resolveHookConfiguration(projectRoot, {}, configDir);
+    const entries = flattenResolvedHooks(resolution);
     if (subcommand === "list") {
-        for (const entry of [...globalEntries, ...projectEntries]) {
+        for (const entry of entries)
             console.log(formatHookEntry(entry));
-        }
-        if (globalEntries.length === 0 && projectEntries.length === 0) {
+        if (entries.length === 0)
             console.log("No hooks configured.");
-        }
-        if (project.diagnostic) {
-            console.error(`Project hooks diagnostic: ${project.diagnostic}`);
+        for (const diagnostic of hookErrors(resolution)) {
+            console.error(`Hooks diagnostic: ${formatDiagnostic(diagnostic)}`);
         }
         return;
     }
     if (subcommand === "check") {
-        if (project.diagnostic) {
-            throw new Error(`Hook check failed: ${project.diagnostic}`);
-        }
-        console.log(`Hooks OK: ${globalEntries.length} global, ${projectEntries.length} project`);
+        assertHookResolutionValid(resolution);
+        const globalHooksCount = entries.filter((entry) => entry.scope === "global").length;
+        const projectHooksCount = entries.filter((entry) => entry.scope === "project").length;
+        console.log(`Hooks OK: ${globalHooksCount} global, ${projectHooksCount} project`);
         return;
     }
     throw new Error(`Unknown hooks command: ${subcommand}`);
 }
-function loadGlobalHooks() {
-    const files = loadForgeRelayFiles();
-    return mergeHookConfigs(parseHookConfig(files.config.hooks), parseHookConfig(files.hooks), files.hookFiles);
+async function resolveHookConfiguration(projectRoot, legacyUser, configDir, sourceRuntime) {
+    const project = configDir ? await resolveProjectContext(configDir, projectRoot) : undefined;
+    return resolveHooksConfig({
+        ...(configDir ? { configDir } : {}),
+        ...(project ? { project } : {}),
+        projectSharedConfigDir: join(projectRoot, ".forgerelay"),
+        legacyUser,
+        ...(sourceRuntime ? { sourceRuntime } : {}),
+    });
+}
+function flattenResolvedHooks(resolution) {
+    const counters = new Map();
+    return effectiveHookConfigEntries(resolution).flatMap((entry) => entry.entries.map((hook) => {
+        const scope = entry.scope === "user" ? "global" : "project";
+        const counterKey = `${scope}:${hook.event}`;
+        const index = (counters.get(counterKey) ?? 0) + 1;
+        counters.set(counterKey, index);
+        const synthetic = entry.name.startsWith("@legacy/");
+        return {
+            scope,
+            event: hook.event,
+            name: hook.name ?? (synthetic ? `${hook.event} handler ${index}` : entry.name),
+            ...(hook.matcher ? { matcher: hook.matcher } : {}),
+            command: hook.command,
+            timeoutSeconds: hook.timeoutSeconds ?? 30,
+            report: hook.report ?? true,
+        };
+    }));
+}
+function hookErrors(resolution) {
+    return resolution.diagnostics.filter((diagnostic) => diagnostic.severity === "error");
+}
+function assertHookResolutionValid(resolution) {
+    const errors = hookErrors(resolution);
+    if (errors.length === 0)
+        return;
+    throw new Error(`Hook check failed: ${errors.map(formatDiagnostic).join(" | ")}`);
+}
+function formatDiagnostic(diagnostic) {
+    return `${diagnostic.source.location ?? diagnostic.source.id}: ${diagnostic.message}`;
 }
 function parseProjectRoot(args) {
     let projectRoot = process.cwd();
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
-        if (arg !== "--project") {
+        if (arg !== "--project")
             throw new Error(`Unknown hooks option: ${arg}`);
-        }
         const value = args[index + 1];
         if (!value)
             throw new Error("Usage: forgerelay hooks <list|check> [--project <path>]");
@@ -64,27 +95,6 @@ function parseProjectRoot(args) {
     }
     return projectRoot;
 }
-function flattenHooks(config, scope) {
-    const entries = [];
-    for (const event of HOOK_EVENTS) {
-        let handlerIndex = 0;
-        for (const rule of config[event] ?? []) {
-            for (const handler of rule.handlers) {
-                handlerIndex += 1;
-                entries.push({
-                    scope,
-                    event,
-                    name: handler.name ?? `${event} handler ${handlerIndex}`,
-                    matcher: rule.matcher,
-                    command: handler.command,
-                    timeoutSeconds: handler.timeoutSeconds,
-                    report: handler.report,
-                });
-            }
-        }
-    }
-    return entries;
-}
 function formatHookEntry(entry) {
     const matcher = formatMatcher(entry.matcher);
     return `${entry.scope} ${entry.name} ${entry.event} ${matcher} timeout=${entry.timeoutSeconds}s report=${entry.report} :: ${entry.command}`;

package/dist/mcp/hooks/hooks.js

@@ -1,27 +1,17 @@
-import { readFile, readdir } from "node:fs/promises";
 import { join } from "node:path";
 import { performance } from "node:perf_hooks";
 import { commandPreview, logEvent, workspaceLogLabel } from "../../runtime/logging/logger.js";
-import { resolveCompatibilityCommandShellRuntime, snapshotCommandShellRuntime, } from "../../runtime/shell/command-shell-runtime.js";
+import { resolveCompatibilityCommandShellRuntime, snapshotCommandShellRuntime } from "../../runtime/shell/command-shell-runtime.js";
 import { resolveShellCommandForRuntime } from "../process/process-platform.js";
 import { executeHookCommand, hookFailureOutput } from "./command-runner.js";
-export const HOOK_EVENTS = [
-    "WorkspaceOpen",
-    "BeforeTool",
-    "AfterTool",
-    "AfterToolFailure",
-    "ExternalMcpBeforeForward",
-    "ExternalMcpAfterForward",
-    "AfterFileChange",
-    "BeforeWorktreeClose",
-    "AfterWorktreeClose",
-    "SubagentStart",
-    "SubagentStop",
-];
+import { resolveProjectContext } from "../../workspaces/state/project-context.js";
+import { effectiveHookConfigEntries, resolveHooksConfig } from "../../runtime/config/resolution/hooks.js";
+import { compatibilityAllowProjectExecutionTrustPolicy, projectExecutionRequirement } from "../../runtime/security/project-execution-trust.js";
+import { ConfigSourceRuntime } from "../../runtime/config/runtime/source-refresh.js";
+import { HOOK_EVENTS } from "./config.js";
+export { HOOK_EVENTS } from "./config.js";
 const DEFAULT_HOOK_TIMEOUT_SECONDS = 30;
 const MAX_HOOK_TIMEOUT_SECONDS = 300;
-const PROJECT_HOOKS_PATH = join(".forgerelay", "hooks.json");
-const PROJECT_HOOKS_DIR = join(".forgerelay", "hooks");
 const BLOCKING_EVENTS = new Set([
     "BeforeTool",
     "ExternalMcpBeforeForward",
@@ -215,17 +205,64 @@ function formatHookReports(executions) {
         }),
     ].join("\n");
 }
+export async function resolveHookExecutionPlan(input) {
+    let projectRoot = input.event === "AfterWorktreeClose" && input.invocation.sourceRoot
+        ? input.invocation.sourceRoot
+        : input.invocation.workspaceRoot;
+    let project = input.project;
+    if (!project && input.configDir) {
+        try {
+            project = await resolveProjectContext(input.configDir, projectRoot);
+        }
+        catch (error) {
+            const sourceRoot = input.invocation.sourceRoot;
+            if (!sourceRoot || projectRoot === sourceRoot || !isMissingPath(error))
+                throw error;
+            projectRoot = sourceRoot;
+            project = await resolveProjectContext(input.configDir, projectRoot);
+        }
+    }
+    const resolution = await resolveHooksConfig({
+        ...(input.configDir ? { configDir: input.configDir } : {}),
+        ...(project ? { project } : {}),
+        projectSharedConfigDir: join(projectRoot, ".forgerelay"),
+        legacyUser: input.legacyUser, ...(input.sourceRuntime ? { sourceRuntime: input.sourceRuntime } : {}),
+    });
+    const handlers = effectiveHookConfigEntries(resolution).flatMap((entry) => entry.entries.flatMap((hook) => {
+        if (hook.event !== input.event)
+            return [];
+        const matchedInvocation = matchHookRule(hook.matcher, input.invocation);
+        if (!matchedInvocation)
+            return [];
+        const requirement = project ? projectExecutionRequirement({
+            projectId: project.id, resolution, entryKey: `hooks.${entry.name}`,
+            display: { kind: "hook", name: entry.name },
+        }) : undefined;
+        return [{
+                scope: entry.scope === "user" ? "global" : "project",
+                handler: resolvedHookHandler(entry.name, hook), invocation: matchedInvocation,
+                ...(requirement ? { executionRequirement: requirement } : {}),
+            }];
+    }));
+    return { handlers, resolution };
+}
 export class HookRunner {
     hooks;
     logging;
     baseEnv;
     resultDecorator;
+    configDir;
+    sourceRuntime;
+    projectExecutionTrustPolicy;
     commandShellRuntime;
-    constructor(hooks, logging, baseEnv = process.env, resultDecorator, commandShellRuntime) {
+    constructor(hooks, logging, baseEnv = process.env, resultDecorator, commandShellRuntime, configDir, sourceRuntime = new ConfigSourceRuntime(), projectExecutionTrustPolicy = compatibilityAllowProjectExecutionTrustPolicy) {
         this.hooks = hooks;
         this.logging = logging;
         this.baseEnv = baseEnv;
         this.resultDecorator = resultDecorator;
+        this.configDir = configDir;
+        this.sourceRuntime = sourceRuntime;
+        this.projectExecutionTrustPolicy = projectExecutionTrustPolicy;
         this.commandShellRuntime = snapshotCommandShellRuntime(commandShellRuntime ?? resolveCompatibilityCommandShellRuntime(process.platform, baseEnv));
     }
     decorateResult(workspaceId, result) {
@@ -233,34 +270,18 @@ export class HookRunner {
     }
     async run(event, invocation, signal) {
         signal?.throwIfAborted();
-        const projectRoot = event === "AfterWorktreeClose" && invocation.sourceRoot
-            ? invocation.sourceRoot
-            : invocation.workspaceRoot;
-        const project = await loadProjectHookConfig(projectRoot);
-        const handlers = [
-            ...(this.hooks[event] ?? []).map((rule) => ({ scope: "global", rule })),
-            ...(project.hooks[event] ?? []).map((rule) => ({ scope: "project", rule })),
-        ].flatMap(({ scope, rule }) => {
-            const matchedInvocation = matchHookRule(rule.matcher, invocation);
-            if (!matchedInvocation)
-                return [];
-            return rule.handlers.map((handler) => ({ scope, handler, invocation: matchedInvocation }));
+        const plan = await resolveHookExecutionPlan({
+            event,
+            invocation,
+            legacyUser: this.hooks,
+            ...(this.configDir ? { configDir: this.configDir } : {}), sourceRuntime: this.sourceRuntime,
         });
         const blocking = BLOCKING_EVENTS.has(event);
-        const executions = project.diagnostic
-            ? [{
-                    event,
-                    name: "Project hooks config",
-                    scope: "project",
-                    status: "failed",
-                    durationMs: 0,
-                    report: true,
-                    error: project.diagnostic,
-                }]
-            : [];
-        for (const [index, { scope, handler, invocation: matchedInvocation }] of handlers.entries()) {
+        const executions = hookResolutionReports(plan.resolution, event);
+        const handlers = plan.handlers;
+        for (const [index, { scope, handler, invocation: matchedInvocation, executionRequirement }] of handlers.entries()) {
             signal?.throwIfAborted();
-            const execution = await this.runHandler(event, handler, index, matchedInvocation, scope, signal);
+            const execution = await this.runHandler(event, handler, index, matchedInvocation, scope, executionRequirement, signal);
             executions.push(execution);
             logEvent(this.logging, execution.status === "passed" ? "info" : "warn", "hook_call", {
                 hookEvent: event,
@@ -281,13 +302,15 @@ export class HookRunner {
         }
         return executions;
     }
-    async runHandler(event, handler, index, invocation, scope, signal) {
+    async runHandler(event, handler, index, invocation, scope, executionRequirement, signal) {
         const startedAt = performance.now();
         const name = handler.name ?? `${event} handler ${index + 1}`;
         const shell = resolveShellCommandForRuntime(handler.command, this.commandShellRuntime);
         const detached = process.platform !== "win32";
         const env = hookEnvironment(this.baseEnv, event, invocation);
         try {
+            if (executionRequirement)
+                await this.projectExecutionTrustPolicy.authorize(executionRequirement);
             const result = await executeHookCommand({
                 executable: shell.executable,
                 args: shell.args,
@@ -340,12 +363,54 @@ export class HookRunner {
         }
     }
 }
+function resolvedHookHandler(name, hook) {
+    const legacySyntheticName = name.startsWith("@legacy/");
+    return {
+        ...((hook.name ?? (!legacySyntheticName ? name : undefined))
+            ? { name: hook.name ?? name }
+            : {}),
+        command: hook.command,
+        timeoutSeconds: hook.timeoutSeconds ?? DEFAULT_HOOK_TIMEOUT_SECONDS,
+        report: hook.report ?? true,
+    };
+}
+function hookResolutionReports(resolution, event) {
+    const grouped = new Map();
+    for (const diagnostic of resolution.diagnostics) {
+        if (diagnostic.severity !== "error" || diagnostic.diagnosticChanged === false)
+            continue;
+        const scope = diagnostic.source.scope === "user"
+            ? "global"
+            : diagnostic.source.scope === "project" || diagnostic.source.scope === "project-local"
+                ? "project"
+                : undefined;
+        if (!scope)
+            continue;
+        const location = diagnostic.source.location ?? diagnostic.source.id;
+        grouped.set(scope, [...(grouped.get(scope) ?? []), `${location}: ${diagnostic.message}`]);
+    }
+    return ["global", "project"].flatMap((scope) => {
+        const errors = grouped.get(scope);
+        if (!errors?.length)
+            return [];
+        return [{
+                event,
+                name: scope === "global" ? "Global hooks config" : "Project hooks config",
+                scope,
+                status: "failed",
+                durationMs: 0,
+                report: true,
+                error: errors.join(" | "),
+            }];
+    });
+}
 function parseHookRule(event, value, index) {
     if (!isRecord(value)) {
         throw new Error(`Hook ${event} entry ${index + 1} must be an object`);
     }
     if (!("handlers" in value)) {
         return {
+            matcher: parseHookMatcher(event, value.matcher, index),
             handlers: [parseHookHandler(event, value, index)],
         };
     }
@@ -467,45 +532,6 @@ function assertValidRegex(event, field, pattern) {
         throw new Error(`Hook ${event} matcher ${field} must be a valid regular expression`);
     }
 }
-export async function loadProjectHookConfig(workspaceRoot) {
-    let hooks = {};
-    const diagnostics = [];
-    const aggregatePath = join(workspaceRoot, PROJECT_HOOKS_PATH);
-    try {
-        const content = await readFile(aggregatePath, "utf8");
-        hooks = mergeHookConfigs(hooks, parseHookConfig(JSON.parse(content)));
-    }
-    catch (error) {
-        if (!(isErrnoException(error) && (error.code === "ENOENT" || error.code === "ENOTDIR"))) {
-            diagnostics.push(`Could not load project hooks at ${aggregatePath}: ${errorMessage(error)}`);
-        }
-    }
-    const directory = join(workspaceRoot, PROJECT_HOOKS_DIR);
-    try {
-        const entries = (await readdir(directory, { withFileTypes: true }))
-            .filter((entry) => entry.isFile() && entry.name.endsWith(".json"))
-            .sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
-        for (const entry of entries) {
-            const path = join(directory, entry.name);
-            try {
-                const value = JSON.parse(await readFile(path, "utf8"));
-                hooks = mergeHookConfigs(hooks, parseHookFile(value, entry.name.slice(0, -5)));
-            }
-            catch (error) {
-                diagnostics.push(`Could not load project hook at ${path}: ${errorMessage(error)}`);
-            }
-        }
-    }
-    catch (error) {
-        if (!(isErrnoException(error) && (error.code === "ENOENT" || error.code === "ENOTDIR"))) {
-            diagnostics.push(`Could not read project hook directory at ${directory}: ${errorMessage(error)}`);
-        }
-    }
-    return {
-        hooks,
-        ...(diagnostics.length > 0 ? { diagnostic: diagnostics.join(" | ") } : {}),
-    };
-}
 export function matchHookRule(matcher, invocation) {
     if (!matcher)
         return invocation;
@@ -580,8 +606,8 @@ function hookEnvironment(baseEnv, event, invocation) {
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
-function isErrnoException(error) {
-    return error instanceof Error && "code" in error;
+function isMissingPath(error) {
+    return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/mcp/operations/external-mcp/external-mcp-runtime.js

@@ -2,7 +2,7 @@ import { ExternalMcpConfigRegistry } from "../../../runtime/config/external-mcp-
 import { ExternalMcpCredentialStore } from "../../../runtime/config/external-mcp-auth-store.js";
 import { logEvent } from "../../../runtime/logging/logger.js";
 import { CapabilityError } from "../../server/core/capability-registry.js";
-import { requireCapabilityWorkspaceRoot } from "../../server/core/capability-support.js";
+import { requireCapabilityProject, requireCapabilityWorkspaceRoot, } from "../../server/core/capability-support.js";
 import { ExternalMcpTransformError, ExternalMcpTransformRunner, } from "../../hooks/external-mcp-transform.js";
 import { ExternalMcpError, ExternalMcpGateway } from "./external-mcp.js";
 export function createExternalMcpCapabilityRuntime(config) {
@@ -10,24 +10,26 @@ export function createExternalMcpCapabilityRuntime(config) {
     const externalMcp = new ExternalMcpGateway(config.mediaMaxBytes, credentialStore);
     const registry = new ExternalMcpConfigRegistry({
         configDir: config.configDir,
-        legacyServers: config.mcpServers,
+        sourceRuntime: config.configRuntime.sources,
         onDiagnostic: (diagnostic) => logEvent(config.logging, "warn", "external_mcp_config_invalid", {
             source: diagnostic.source,
             path: diagnostic.path,
             reason: diagnostic.message,
         }),
     });
-    const transforms = new ExternalMcpTransformRunner(config.hooks, config.logging, process.env, config.commandShellRuntime, config.mediaMaxBytes);
+    const transforms = new ExternalMcpTransformRunner({}, config.logging, process.env, config.commandShellRuntime, config.mediaMaxBytes, config.configDir, config.configRuntime.sources);
     return {
         available: true,
         run: async (input, context, runOptions) => {
             try {
                 const workspaceRoot = requireCapabilityWorkspaceRoot(context);
-                const snapshot = registry.resolve(workspaceRoot);
+                const project = requireCapabilityProject(context);
+                const snapshot = registry.resolve(project);
                 const transformContext = (server, tool) => ({
                     workspaceId: context.workspaceId,
                     workspaceRoot,
                     workspaceMode: context.workspaceMode,
+                    project,
                     server,
                     tool,
                 });
@@ -37,8 +39,9 @@ export function createExternalMcpCapabilityRuntime(config) {
                         result: (server, tool, externalResult) => transforms.transformResult(transformContext(server, tool), externalResult, runOptions.signal),
                     }
                     : undefined, {
-                    workspaceRoot,
+                    project: { id: project.id, projectRoot: project.projectRoot },
                     origins: snapshot.origins,
+                    executionRequirements: snapshot.executionRequirements,
                 });
                 return {
                     value: result.value,

package/dist/mcp/operations/external-mcp/external-mcp.js

@@ -3,6 +3,7 @@ import { AuthorizationServerMismatchError, Client, InsufficientScopeError, SdkHt
 import { StdioClientTransport, getDefaultEnvironment, } from "@modelcontextprotocol/client/stdio";
 import { CallToolResultSchema } from "@modelcontextprotocol/core";
 import { externalMcpCredentialIdentity, } from "../../../runtime/config/external-mcp-auth-store.js";
+import { compatibilityAllowProjectExecutionTrustPolicy, } from "../../../runtime/security/project-execution-trust.js";
 import { claimMediaBytes, createMediaBudget, isSupportedImageMimeType, strictBase64ByteLength, } from "../media-content.js";
 import { ExternalMcpTransformError, } from "../../hooks/external-mcp-transform.js";
 import { ExternalMcpOAuthError, createExternalMcpRuntimeAuth, externalMcpAuthError, markExternalMcpAuthorizationRequired, markExternalMcpReauthorization, } from "./external-mcp-oauth.js";
@@ -24,10 +25,12 @@ export class ExternalMcpError extends Error {
 export class ExternalMcpGateway {
     mediaMaxBytes;
     credentialStore;
+    projectExecutionTrustPolicy;
     negotiationCache = new Map();
-    constructor(mediaMaxBytes, credentialStore) {
+    constructor(mediaMaxBytes, credentialStore, projectExecutionTrustPolicy = compatibilityAllowProjectExecutionTrustPolicy) {
         this.mediaMaxBytes = mediaMaxBytes;
         this.credentialStore = credentialStore;
+        this.projectExecutionTrustPolicy = projectExecutionTrustPolicy;
     }
     async run(servers, input, signal, transforms, authContext) {
         signal?.throwIfAborted();
@@ -121,6 +124,10 @@ export class ExternalMcpGateway {
             throw new ExternalMcpError("unknown_server", `Unknown configured external MCP server: ${name}.`);
         const fingerprint = externalMcpServerFingerprint(config);
         const runtimeAuth = this.resolveRuntimeAuth(name, config, authContext);
+        const requirement = authContext?.executionRequirements?.[name];
+        if (config.transport === "stdio" && requirement) {
+            await this.projectExecutionTrustPolicy.authorize(requirement);
+        }
         const client = new Client({ name: "forgerelay-external-mcp", version: "1.0.0" }, { versionNegotiation: { mode: "auto" } });
         const transport = createTransport(config, runtimeAuth?.authProvider);
         const prior = this.cachedPrior(name, fingerprint);
@@ -169,7 +176,7 @@ export class ExternalMcpGateway {
         const source = context.origins[name];
         if (!source)
             return undefined;
-        const identity = externalMcpCredentialIdentity(source, name, context.workspaceRoot);
+        const identity = externalMcpCredentialIdentity(source, name, context.project);
         return createExternalMcpRuntimeAuth(this.credentialStore, identity, config.url);
     }
     cachedPrior(name, fingerprint) {

package/dist/mcp/server/core/capability-support.js

@@ -16,6 +16,7 @@ export function capabilityContextFor(workspace) {
         workspaceRoot: workspace.root,
         workspaceMode: workspace.mode,
         workspaceManaged: workspace.worktree?.managed ?? false,
+        ...(workspace.project ? { project: workspace.project } : {}),
         guides: workspace.capabilityGuides.map((guide) => ({
             name: guide.name,
             description: guide.description,
@@ -56,6 +57,12 @@ export function requireCapabilityWorkspaceRoot(context) {
     }
     return context.workspaceRoot;
 }
+export function requireCapabilityProject(context) {
+    if (!context.project) {
+        throw new CapabilityError("capability_unavailable", `Capability execution requires Project identity for Workspace ${context.workspaceId}.`);
+    }
+    return context.project;
+}
 export function runWorkspaceTasksCapability(store, workspaceId, input) {
     switch (input.operation) {
         case "get":