@askthew/mcp-plugin 0.4.10 → 0.4.12

package/dist/index.js

@@ -1,18 +1,11 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { spawn } from "node:child_process";
-import fs from "node:fs";
 import { createRequire } from "node:module";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
 import { z } from "zod";
+import { AskTheWCloudClient, completeSignup, startSignup } from "./cloud-client.js";
+import { Outbox, sendOutboxPayload } from "./outbox.js";
+import { redactSignalPayload } from "./redaction.js";
 import { resolvePluginScope } from "./scope.js";
-import { resolveMcpMode } from "./lib/free-tier-policy.js";
-import { LocalStore } from "./lib/local-store.js";
-import { buildTelemetryPayload, flushTelemetryOutbox } from "./lib/telemetry.js";
-import { ensureLocalIdentity } from "./lib/local-identity.js";
-import { paidFeatureNudge, toolJson } from "./lib/upgrade-nudge.js";
-import { configPath, readJsonFile } from "./lib/paths.js";
 const requirePackageJson = createRequire(import.meta.url);
 function packageVersion() {
     try {
@@ -27,12 +20,8 @@ const evidenceRoleSchema = z.enum(["user", "assistant", "system"]);
 const evidenceEntrySchema = z.object({
     role: evidenceRoleSchema,
     excerpt: z.string().min(1).max(2000),
-    kind: z.enum(["excerpt", "diff", "prompt_diff"]).optional(),
-    diff: z.string().max(12000).optional(),
-    before: z.string().max(6000).optional(),
-    after: z.string().max(6000).optional(),
 });
-const sessionSignalKindSchema = z.enum([
+const signalKindSchema = z.enum([
     "setup_complete",
     "session_checkpoint",
     "direction_change",
@@ -40,1394 +29,207 @@ const sessionSignalKindSchema = z.enum([
     "verification_result",
     "final_summary",
 ]);
+const idempotencyKeySchema = z
+    .string()
+    .min(16)
+    .refine((value) => !/^[A-Za-z0-9_.:/-]+-\d+$/.test(value), {
+    message: "Use a ULID or 16+ char random key, not sessionId-sequence.",
+});
 export const codingSessionSignalSchema = z.object({
     sessionId: z.string().min(1),
     sequence: z.number().int().nonnegative(),
-    kind: sessionSignalKindSchema,
+    kind: signalKindSchema,
     summary: z.string().min(1).max(2000),
-    evidence: z
-        .array(evidenceEntrySchema)
-        .default([]),
+    idempotencyKey: idempotencyKeySchema,
+    clientId: z.enum(["claude_code", "codex", "cursor", "web_agent"]).optional(),
+    scopeKey: z.string().min(1).default("global"),
+    evidence: z.array(evidenceEntrySchema).default([]),
     filesTouched: z.array(z.string().min(1).max(500)).default([]),
     commandsRun: z.array(z.string().min(1).max(500)).default([]),
     metadata: z.record(z.string(), z.unknown()).default({}),
 });
-export const provenanceSignalSchema = z.object({
-    source: z.string().min(1),
-    decision: z.string().min(1),
-    rationale: z.string().min(1),
-    confidence: z.number().min(0).max(1),
-    framework: z.string().optional(),
-    filesAffected: z.array(z.string()).default([]),
-    sessionId: z.string().min(1),
-    pendingApproval: z.boolean().optional(),
-    originatingPrompt: z.string().optional(),
-    installToken: z.string().optional(),
-    metadata: z.record(z.string(), z.unknown()).default({}),
+const decisionSchema = z.object({
+    content: z.string().min(1).max(4000),
+    sourceSignalIds: z.array(z.string().uuid()).default([]),
+    status: z.enum(["proposed", "committed", "shipped", "abandoned"]).default("proposed"),
+    outcomeId: z.string().uuid().optional(),
 });
-const REDACTION_PATTERNS = [
-    { name: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
-    { name: "aws_secret_key", pattern: /\b[A-Za-z0-9+/]{40}\b/g },
-    { name: "gcp_api_key", pattern: /\bAIza[0-9A-Za-z\-_]{35}\b/g },
-    { name: "azure_storage_key", pattern: /[A-Za-z0-9+/]{86}==/g },
-    { name: "stripe_key", pattern: /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}\b/g },
-    { name: "sendgrid_key", pattern: /\bSG\.[A-Za-z0-9_-]{22,}\.[A-Za-z0-9_-]{22,}\b/g },
-    { name: "twilio_key", pattern: /\bSK[0-9a-fA-F]{32}\b/g },
-    { name: "slack_token", pattern: /\bxox[baprs]-[0-9A-Za-z\-]{10,}\b/g },
-    { name: "slack_webhook", pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g },
-    { name: "openai_env_assignment", pattern: /\bOPENAI_API_KEY\s*[=:]\s*["']?sk-[A-Za-z0-9_-]{20,}["']?/g },
-    { name: "openai_key", pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
-    { name: "bearer_token", pattern: /\bBearer\s+[A-Za-z0-9._-]+\b/g },
-    { name: "anthropic_key", pattern: /\bsk-ant-[A-Za-z0-9\-_]{32,}\b/g },
-    { name: "github_pat_classic", pattern: /\bghp_[A-Za-z0-9]{36}\b/g },
-    { name: "github_pat_fine", pattern: /\bgithub_pat_[A-Za-z0-9_]{82}\b/g },
-    { name: "github_oauth", pattern: /\bgho_[A-Za-z0-9]{36}\b/g },
-    { name: "github_app_token", pattern: /\bghs_[A-Za-z0-9]{36}\b/g },
-    { name: "gitlab_pat", pattern: /\bglpat-[A-Za-z0-9\-_]{20,}\b/g },
-    { name: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
-    { name: "pem_private_key", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
-    { name: "db_dsn_with_creds", pattern: /(?:postgres|postgresql|mysql|mongodb(?:\+srv)?|redis):\/\/[^:]+:[^@\s]+@[^\s"'`]+/gi },
-    { name: "atw_token", pattern: /\b(?:atw|askthew)_[a-z]+_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}_[0-9a-f]{16,}\b/gi },
-    { name: "uuid_token", pattern: /\b\w{2,20}_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}(?:_[A-Za-z0-9]{8,})?\b/g },
-    { name: "env_var_assignment", pattern: /(?:^|[\s;|&])(?:export\s+)?[A-Z][A-Z0-9_]{4,}(?:_KEY|_TOKEN|_SECRET|_PASSWORD|_PASS|_CREDENTIAL|_API_KEY|_PRIVATE|_AUTH)\s*[=:]\s*["']?[A-Za-z0-9+/=._~-]{8,}["']?/gm },
-    { name: "email", pattern: /\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/g },
-    { name: "us_phone", pattern: /\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]\d{3}[-.\s]\d{4}\b/g },
-    { name: "ssn", pattern: /\b(?!000|666|9\d{2})\d{3}[-\s](?!00)\d{2}[-\s](?!0{4})\d{4}\b/g },
-    { name: "credit_card", pattern: /\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\b/g },
-];
-const SENSITIVE_QUERY_PARAMS = new Set([
-    "token",
-    "key",
-    "api_key",
-    "apikey",
-    "secret",
-    "password",
-    "passwd",
-    "pass",
-    "auth",
-    "access_token",
-    "refresh_token",
-    "id_token",
-    "client_secret",
-    "authorization",
-    "credential",
-    "sig",
-    "signature",
-]);
-const SENSITIVE_FLAG_NAMES = new Set([
-    "token",
-    "password",
-    "passwd",
-    "pass",
-    "secret",
-    "key",
-    "api-key",
-    "apikey",
-    "api_key",
-    "auth",
-    "access-token",
-    "private-key",
-    "credential",
-    "credentials",
-    "authorization",
-    "client-secret",
-    "client_secret",
-]);
-const SENSITIVE_PATH_SEGMENTS = new Set([
-    ".env",
-    ".ssh",
-    ".aws",
-    ".gcp",
-    ".azure",
-    ".gnupg",
-    ".pgp",
-    "secrets",
-    "secret",
-    "credentials",
-    "credential",
-    "private",
-    "keys",
-    "certs",
-    "certificates",
-    "vault",
-    ".netrc",
-    ".npmrc",
-    ".pypirc",
-    ".docker",
-    "kubeconfig",
-    ".kube",
-]);
-const ENTROPY_THRESHOLD = 4.5;
-const ENTROPY_TOKEN_PATTERN = /[A-Za-z0-9+/=_\-]{20,}/g;
-export function loadAskTheWConfig(env = process.env) {
-    return readJsonFile(configPath(env)) ?? {};
-}
-function isRedactionEnabled() {
-    return loadAskTheWConfig().redaction?.enabled !== false;
-}
-function sanitizeUrl(raw) {
-    try {
-        const url = new URL(raw);
-        if (url.username || url.password) {
-            url.username = "[REDACTED]";
-            url.password = "[REDACTED]";
-        }
-        for (const key of Array.from(url.searchParams.keys())) {
-            if (SENSITIVE_QUERY_PARAMS.has(key.toLowerCase())) {
-                url.searchParams.set(key, "[REDACTED]");
-            }
-        }
-        return url.toString().replace(/%5BREDACTED%5D/gi, "[REDACTED]");
-    }
-    catch {
-        return raw;
-    }
-}
-function sanitizeUrls(text) {
-    return text.replace(/https?:\/\/[^\s"'`<>)\\]*/g, (match) => sanitizeUrl(match));
-}
-function scrubCommandFlags(command) {
-    let result = command.replace(/(-{1,2})([\w-]+)([ =])(["'])([^"']+)\4/g, (match, dashes, flagName, separator, quote) => SENSITIVE_FLAG_NAMES.has(String(flagName).toLowerCase())
-        ? `${dashes}${flagName}${separator}${quote}[REDACTED]${quote}`
-        : match);
-    result = result.replace(/(-{1,2})([\w-]+)([ =])([^\s"'`]+)/g, (match, dashes, flagName, separator) => SENSITIVE_FLAG_NAMES.has(String(flagName).toLowerCase())
-        ? `${dashes}${flagName}${separator}[REDACTED]`
-        : match);
-    return result;
-}
-function shannonEntropy(value) {
-    const freq = new Map();
-    for (const char of value) {
-        freq.set(char, (freq.get(char) ?? 0) + 1);
-    }
-    let entropy = 0;
-    for (const count of freq.values()) {
-        const probability = count / value.length;
-        entropy -= probability * Math.log2(probability);
-    }
-    return entropy;
-}
-function looksLikeSecret(token) {
-    const hasDigit = /\d/.test(token);
-    const hasUpper = /[A-Z]/.test(token);
-    const hasLower = /[a-z]/.test(token);
-    const hasSpecial = /[+/=_\-]/.test(token);
-    return hasDigit && hasLower && (hasUpper || hasSpecial);
-}
-function redactHighEntropyTokens(text) {
-    return text.replace(ENTROPY_TOKEN_PATTERN, (match) => {
-        if (match.includes("/") && match.length < 60) {
-            return match;
-        }
-        if (!looksLikeSecret(match)) {
-            return match;
-        }
-        return shannonEntropy(match) >= ENTROPY_THRESHOLD ? "[REDACTED]" : match;
-    });
-}
-function redactTargetedPatterns(text) {
-    return REDACTION_PATTERNS.reduce((accumulator, entry) => {
-        entry.pattern.lastIndex = 0;
-        return accumulator.replace(entry.pattern, "[REDACTED]");
-    }, text);
-}
-function redactRawSignalText(text) {
-    return redactTargetedPatterns(sanitizeUrls(text));
-}
-function redactOperationalContext(text) {
-    return redactHighEntropyTokens(scrubCommandFlags(redactRawSignalText(text)));
-}
-function sanitizeFilePath(filePath) {
-    let result = filePath.replace(/^(?:[A-Za-z]:\\|\/(?:Users|home|root|var|etc)\/[^/]+\/)/, "~/");
-    result = redactRawSignalText(result);
-    const segments = result.split(/[/\\]/);
-    if (segments.some((segment) => SENSITIVE_PATH_SEGMENTS.has(segment.toLowerCase()))) {
-        const basename = segments[segments.length - 1] ?? result;
-        return `[SENSITIVE_PATH]/${basename}`;
-    }
-    return result;
-}
-function redactMetadata(value, key) {
-    if (typeof value === "string") {
-        const redacted = redactOperationalContext(value);
-        if (key && /(?:^|_)(?:path|root|file|dir|directory)(?:$|_)/i.test(key)) {
-            return sanitizeFilePath(redacted);
-        }
-        return redacted;
-    }
-    if (Array.isArray(value)) {
-        return value.map((entry) => redactMetadata(entry));
-    }
-    if (typeof value === "object" && value !== null) {
-        return Object.fromEntries(Object.entries(value).map(([entryKey, entry]) => [entryKey, redactMetadata(entry, entryKey)]));
-    }
-    return value;
-}
-export function redactProvenanceSignal(input) {
-    const parsed = provenanceSignalSchema.parse(input);
-    if (!isRedactionEnabled()) {
-        return parsed;
-    }
+function toolJson(value) {
     return {
-        ...parsed,
-        decision: redactRawSignalText(parsed.decision),
-        rationale: redactRawSignalText(parsed.rationale),
-        framework: typeof parsed.framework === "string" ? redactRawSignalText(parsed.framework) : undefined,
-        filesAffected: parsed.filesAffected.map((filePath) => sanitizeFilePath(filePath)),
-        originatingPrompt: typeof parsed.originatingPrompt === "string"
-            ? redactOperationalContext(parsed.originatingPrompt)
-            : undefined,
-        installToken: typeof parsed.installToken === "string"
-            ? redactOperationalContext(parsed.installToken)
-            : undefined,
-        metadata: redactMetadata(parsed.metadata),
-    };
-}
-export function redactCodingSessionSignal(input) {
-    const parsed = codingSessionSignalSchema.parse(input);
-    if (!isRedactionEnabled()) {
-        return parsed;
-    }
-    return {
-        ...parsed,
-        summary: redactRawSignalText(parsed.summary),
-        evidence: parsed.evidence.map((entry) => ({
-            ...entry,
-            excerpt: redactOperationalContext(entry.excerpt),
-            diff: typeof entry.diff === "string" ? redactOperationalContext(entry.diff) : undefined,
-            before: typeof entry.before === "string" ? redactOperationalContext(entry.before) : undefined,
-            after: typeof entry.after === "string" ? redactOperationalContext(entry.after) : undefined,
-        })),
-        filesTouched: parsed.filesTouched.map((filePath) => sanitizeFilePath(filePath)),
-        commandsRun: parsed.commandsRun.map((command) => redactOperationalContext(command)),
-        metadata: redactMetadata(parsed.metadata),
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify(value, null, 2),
+            },
+        ],
     };
 }
-function apiBaseUrl(override) {
-    return override?.trim() || process.env.ASKTHEW_API_URL?.trim() || "https://app.askthew.com";
-}
-function normalizeClientId(value) {
-    return String(value ?? "")
-        .trim()
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, "_")
-        .replace(/^_+|_+$/g, "")
-        .slice(0, 64);
-}
-export function normalizeInstallTokenInput(token) {
-    return String(token ?? "").trim().replace(/^['"]/, "").replace(/['"]$/, "");
-}
-const echoSchema = z.enum(["summary", "full"]).optional();
-const cursorSchema = z.string().optional();
-const idempotencyKeySchema = z.string().min(1).max(200).optional();
-const maxCharsSchema = z.number().int().positive().max(100000).optional();
-const LIMITED_LOCAL_TOOL_LIMIT = 3;
-const LIMIT_REACHED_MESSAGE = "Limit reached. Upgrade to the paid plan.";
-function traceId() {
-    return `trace_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
-}
-function structuredError(input) {
-    return {
+function needsSignup() {
+    return toolJson({
         ok: false,
-        code: input.code,
-        message: input.message,
-        retryable: Boolean(input.retryable),
-        hint: input.hint ?? "",
-        traceId: input.traceId ?? traceId(),
-        ...(typeof input.status === "number" ? { status: input.status } : {}),
-        ...(input.extra ?? {}),
-    };
-}
-function withResponseShape(route, responseShape = "v2") {
-    const [path, query = ""] = route.split("?");
-    const searchParams = new URLSearchParams(query);
-    searchParams.set("response_shape", responseShape);
-    const nextQuery = searchParams.toString();
-    return nextQuery ? `${path}?${nextQuery}` : path;
-}
-function routeWithQuery(route, params) {
-    const searchParams = new URLSearchParams();
-    for (const [key, value] of Object.entries(params)) {
-        if (value === undefined || value === null || value === "") {
-            continue;
-        }
-        searchParams.set(key, String(value));
-    }
-    const query = searchParams.toString();
-    return query ? `${route}?${query}` : route;
-}
-function credentials(overrides) {
-    const legacyHostType = process.env.ASKTHEW_HOST_TYPE?.trim();
-    const hostType = legacyHostType === "claude_code" || legacyHostType === "codex" || legacyHostType === "cursor"
-        ? legacyHostType
-        : undefined;
-    const overrideHostType = overrides?.hostType;
-    const clientId = normalizeClientId(overrides?.clientId) ||
-        normalizeClientId(process.env.ASKTHEW_CLIENT_ID?.trim()) ||
-        overrideHostType ||
-        hostType ||
-        "mcp_client";
-    return {
-        installToken: normalizeInstallTokenInput(overrides?.installToken) ||
-            normalizeInstallTokenInput(process.env.ASKTHEW_INSTALL_TOKEN),
-        userId: overrides?.userId?.trim() || process.env.ASKTHEW_USER_ID?.trim(),
-        apiKey: overrides?.apiKey?.trim() || process.env.ASKTHEW_API_KEY?.trim(),
-        serverName: overrides?.serverName?.trim() || process.env.ASKTHEW_SERVER_NAME?.trim(),
-        clientId,
-        clientLabel: overrides?.clientLabel?.trim() || process.env.ASKTHEW_CLIENT_LABEL?.trim(),
-        hostType: overrideHostType || hostType,
-    };
-}
-function hasServerIdentity(overrides) {
-    const { installToken, userId } = credentials(overrides);
-    return Boolean(installToken || userId);
-}
-async function postToServer(route, payload, options, request) {
-    if (!hasServerIdentity(options?.credentials)) {
-        return null;
-    }
-    const { installToken, userId, apiKey, clientId, clientLabel, hostType } = credentials(options?.credentials);
-    const fetcher = options?.fetchImpl ?? fetch;
-    const method = request?.method ?? "POST";
-    const bodyPayload = {
-        ...payload,
-        installToken: installToken || undefined,
-        userId: userId || undefined,
-        clientId,
-        clientLabel: clientLabel || undefined,
-        hostType: hostType || undefined,
-    };
-    const response = await fetcher(`${apiBaseUrl(options?.apiBaseUrl)}${route}`, {
-        method,
-        headers: {
-            ...(method === "GET" ? {} : { "Content-Type": "application/json" }),
-            ...(request?.idempotencyKey ? { "Idempotency-Key": request.idempotencyKey } : {}),
-            ...(installToken
-                ? { Authorization: `Bearer ${installToken}` }
-                : apiKey
-                    ? { Authorization: `Bearer ${apiKey}` }
-                    : {}),
-        },
-        ...(method === "GET" ? {} : { body: JSON.stringify(bodyPayload) }),
-    }).catch(() => null);
-    if (!response) {
-        return structuredError({
-            code: "network_error",
-            message: "Ask The W server could not be reached.",
-            retryable: true,
-            hint: "Check your network connection or retry the same idempotency key.",
-        });
-    }
-    const body = await response.json().catch(() => null);
-    if (!response.ok) {
-        if (body && typeof body === "object") {
-            const record = body;
-            return {
-                ...structuredError({
-                    code: typeof record.code === "string" ? record.code : "http_error",
-                    message: typeof record.message === "string"
-                        ? record.message
-                        : typeof record.error === "string"
-                            ? record.error
-                            : `Ask The W request failed with HTTP ${response.status}.`,
-                    retryable: response.status === 429 || response.status >= 500,
-                    hint: typeof record.hint === "string"
-                        ? record.hint
-                        : response.status >= 500
-                            ? "Retry with the same Idempotency-Key if this was a write."
-                            : "Check the tool input and retry.",
-                    traceId: typeof record.traceId === "string" ? record.traceId : undefined,
-                    status: response.status,
-                }),
-                ...record,
-            };
-        }
-        return structuredError({
-            code: "http_error",
-            message: `Ask The W request failed with HTTP ${response.status}.`,
-            retryable: response.status === 429 || response.status >= 500,
-            hint: response.status >= 500 ? "Retry with the same Idempotency-Key if this was a write." : "Check the tool input and retry.",
-            status: response.status,
-        });
-    }
-    return body;
-}
-function runtimeMetadata(options) {
-    const scope = resolvePluginScope(process.cwd());
-    const { serverName, clientId, clientLabel } = credentials(options?.credentials);
-    const extraMetadata = typeof options?.runtimeMetadata === "function"
-        ? options.runtimeMetadata()
-        : (options?.runtimeMetadata ?? {});
-    return {
-        repository: scope.repoName,
-        repo_name: scope.repoName,
-        scope_key: localScopeKey(),
-        ...(scope.repoRoot ? { repo_root: sanitizeFilePath(scope.repoRoot) } : {}),
-        ...(scope.appPath ? { app_path: sanitizeFilePath(scope.appPath) } : {}),
-        ...(scope.serviceName ? { service_name: scope.serviceName } : {}),
-        ...(serverName ? { server_name: serverName } : {}),
-        ...(clientId ? { client_id: clientId } : {}),
-        ...(clientLabel ? { client_label: clientLabel } : {}),
-        ...extraMetadata,
-    };
-}
-function localScopeKey(cwd = process.cwd()) {
-    const scope = resolvePluginScope(cwd);
-    return [scope.repoRoot || scope.repoName || cwd, scope.appPath ?? "", scope.serviceName ?? ""]
-        .filter(Boolean)
-        .join("::")
-        .replace(/\s+/g, " ")
-        .slice(0, 500);
-}
-function startupSessionId(options) {
-    const scope = resolvePluginScope(process.cwd());
-    const { clientId } = credentials(options?.credentials);
-    const scopeKey = [scope.repoName, scope.appPath, scope.serviceName]
-        .filter((part) => Boolean(part))
-        .join(":") || "workspace";
-    return ["mcp-startup", clientId || "mcp_client", scopeKey]
-        .join(":")
-        .replace(/[^a-zA-Z0-9:_-]+/g, "_")
-        .slice(0, 240);
-}
-function loginCommandHint() {
-    for (const value of [
-        process.env.ASKTHEW_EMAIL,
-        process.env.GIT_AUTHOR_EMAIL,
-        process.env.GIT_COMMITTER_EMAIL,
-        process.env.EMAIL,
-    ]) {
-        const email = String(value ?? "").trim();
-        if (/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
-            return `npx -y --prefer-online --package @askthew/mcp-plugin@latest askthew-mcp identify --email ${email}`;
-        }
-    }
-    return "npx -y --prefer-online --package @askthew/mcp-plugin@latest askthew-mcp identify --email <your-email>";
+        code: "needs_signup",
+        message: "Ask The W needs signup before this tool can run. Call askthew_start_signup({email}), then askthew_complete_signup({email, code}).",
+    });
 }
-async function sendStartupHeartbeat(options) {
-    if (!hasServerIdentity(options?.credentials)) {
-        return;
-    }
-    const { installToken, apiKey, clientId, clientLabel, hostType, serverName } = credentials(options?.credentials);
-    if (!installToken) {
-        return;
-    }
+function defaultScopeKey() {
     const scope = resolvePluginScope(process.cwd());
-    const fetcher = options?.fetchImpl ?? fetch;
-    await fetcher(`${apiBaseUrl(options?.apiBaseUrl)}/api/connectors/mcp/heartbeat`, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
-        },
-        body: JSON.stringify({
-            installToken,
-            clientId,
-            ...(clientLabel ? { clientLabel } : {}),
-            hostType,
-            ...(serverName ? { serverName } : {}),
-            repoName: scope.repoName,
-            ...(scope.repoRoot ? { repoRoot: scope.repoRoot } : {}),
-            ...(scope.appPath ? { appPath: scope.appPath } : {}),
-            ...(scope.serviceName ? { serviceName: scope.serviceName } : {}),
-        }),
-    }).catch(() => null);
-}
-async function sendStartupSetupSignal(options) {
-    const sessionSignal = {
-        sessionId: startupSessionId(options),
-        sequence: 0,
-        kind: "setup_complete",
-        summary: "Ask The W plugin server started for this coding-agent session.",
-        evidence: [],
-        filesTouched: [],
-        commandsRun: [],
-        metadata: {
-            ...runtimeMetadata(options),
-            automated: true,
-            operational: true,
-            origin: "mcp_server_startup",
-        },
-    };
-    await postToServer("/api/ingest/mcp", {
-        sessionSignal: redactCodingSessionSignal(sessionSignal),
-    }, options);
-}
-async function sendStartupSignals(options) {
-    await sendStartupHeartbeat(options).catch(() => null);
-    await sendStartupSetupSignal(options).catch(() => null);
+    if (scope.repoRoot)
+        return `repo:${scope.repoRoot}`;
+    if (scope.serviceName)
+        return `project:${scope.serviceName}`;
+    return "global";
 }
 export function createAskTheWMcpServer(options = {}) {
-    const initialMode = resolveMcpMode();
-    if (initialMode.mode === "free_pending_auth") {
-        ensureLocalIdentity({
-            emailClaim: process.env.ASKTHEW_EMAIL,
-            apiUrl: options.apiBaseUrl,
-            telemetryOptOut: process.env.ASKTHEW_TELEMETRY === "off",
-        });
-    }
-    const resolvedMode = resolveMcpMode();
-    const optionInstallToken = normalizeInstallTokenInput(options.credentials?.installToken);
-    const mode = optionInstallToken
-        ? { mode: "paid", installToken: optionInstallToken, reason: "options_install_token" }
-        : resolvedMode;
-    const localStore = mode.mode === "paid" ? null : LocalStore.open();
-    if (localStore && mode.mode === "free" && mode.cliCredentials) {
-        void flushTelemetryOutbox({
-            store: localStore,
-            credentials: mode.cliCredentials,
-            apiUrl: options.apiBaseUrl,
-            fetchImpl: options.fetchImpl,
-        }).catch(() => null);
-    }
     const server = new McpServer({
-        name: "Ask The W Coding Agent Connector",
+        name: "Ask The W MCP",
         version: packageVersion(),
     });
-    if (options.sendStartupHeartbeat !== false && mode.mode === "paid") {
-        void sendStartupSignals(options);
-    }
-    const apiToolResponse = async (route, payload = {}, method = "GET", request) => {
-        const upstream = await postToServer(route, payload, options, { method, idempotencyKey: request?.idempotencyKey });
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify(upstream, null, 2),
-                },
-            ],
-        };
-    };
-    const localResponse = (value) => toolJson(value);
-    const localToolError = (input) => localResponse(structuredError(input));
-    const budgetedLocalResponse = (value, maxChars) => {
-        if (!maxChars || JSON.stringify(value, null, 2).length <= maxChars) {
-            return localResponse(value);
-        }
-        const next = { ...value, truncated: true, maxChars };
-        for (const key of ["signals", "decisions", "decisionCandidates", "matches"]) {
-            const list = next[key];
-            if (Array.isArray(list)) {
-                while (list.length > 0 && JSON.stringify(next, null, 2).length > maxChars) {
-                    list.pop();
-                }
-                next[key] = list;
-            }
-        }
-        if (typeof next.rendered === "string" && JSON.stringify(next, null, 2).length > maxChars) {
-            const overhead = JSON.stringify({ ...next, rendered: "" }, null, 2).length + 80;
-            next.rendered = `${next.rendered.slice(0, Math.max(0, maxChars - overhead)).trimEnd()}\n\n[truncated to max_chars=${maxChars}]`;
-        }
-        return localResponse(next);
-    };
-    const currentScopeKey = () => localScopeKey();
-    const compactWriteResponse = (input) => localResponse({
-        ok: input.ok !== false,
-        id: input.id ?? null,
-        ...(input.decisionId ? { decisionId: input.decisionId } : {}),
-        ...(input.sessionId ? { sessionId: input.sessionId } : {}),
-        ...(typeof input.sequence === "number" ? { sequence: input.sequence } : {}),
-        ...(typeof input.signalCount === "number" ? { signalCount: input.signalCount } : {}),
-        ...(input.warnings && input.warnings.length > 0 ? { warnings: input.warnings } : {}),
-    });
-    const upstreamId = (upstream) => {
-        if (!upstream || typeof upstream !== "object")
-            return null;
-        const record = upstream;
-        return (record.id ??
-            record.signalId ??
-            record.entry?.id ??
-            record.decision?.id ??
-            record.data?.id ??
-            record.data?.outcome?.id ??
-            record.data?.decision?.id ??
-            null);
-    };
-    const upstreamSequence = (upstream) => {
-        if (!upstream || typeof upstream !== "object")
-            return null;
-        const record = upstream;
-        const sequence = record.sequence ?? record.entry?.sequence ?? record.data?.sequence ?? null;
-        return typeof sequence === "number" ? sequence : null;
-    };
-    const upstreamFailure = (upstream) => upstream && typeof upstream === "object" && upstream.ok === false
-        ? upstream
-        : null;
-    const requireFreeIdentity = () => {
-        if (mode.mode === "unauthenticated" || mode.mode === "free_pending_auth") {
-            const loginCommand = loginCommandHint();
-            return localToolError({
-                code: "free_tier_login_required",
-                message: "Free local mode needs a local install identity before capture.",
-                retryable: false,
-                hint: `Run \`${loginCommand}\` or reinstall with \`--free --email <your-email>\`, then restart or reload the MCP host.`,
-                extra: {
-                    loginCommand,
-                    supportEmail: "support@askthew.com",
-                },
-            });
-        }
-        return null;
-    };
-    const limitReachedResponse = (tool) => localResponse({
-        ok: false,
-        code: "free_tier_limit_reached",
-        tool,
-        message: LIMIT_REACHED_MESSAGE,
-        limit: LIMITED_LOCAL_TOOL_LIMIT,
-        pricingUrl: "https://askthew.com/pricing",
-        upgradeUrl: `https://askthew.com/plugin?utm_source=mcp-plugin&utm_medium=tool-limit&utm_campaign=mcp-free&tool=${tool}`,
-        supportEmail: "support@askthew.com",
+    const outbox = options.outbox ?? new Outbox();
+    const client = () => new AskTheWCloudClient({
+        apiUrl: options.apiUrl,
+        fetcher: options.fetcher,
+        env: options.env,
     });
-    const consumeLimitedLocalUse = (tool) => {
-        if (!localStore)
-            return null;
-        const key = `usage:${tool}`;
-        const current = Number(localStore.getMeta(key) || "0");
-        const count = Number.isFinite(current) ? Math.max(0, Math.floor(current)) : 0;
-        if (count >= LIMITED_LOCAL_TOOL_LIMIT) {
-            return limitReachedResponse(tool);
-        }
-        localStore.setMeta(key, String(count + 1));
-        return null;
-    };
-    server.tool("capture_session_signal", {
-        sessionId: z.string().min(1),
-        sequence: z.number().int().nonnegative(),
-        kind: sessionSignalKindSchema,
-        summary: z.string().min(1).max(2000),
-        evidence: z
-            .array(evidenceEntrySchema)
-            .default([]),
-        filesTouched: z.array(z.string().min(1).max(500)).default([]),
-        commandsRun: z.array(z.string().min(1).max(500)).default([]),
-        metadata: z.record(z.string(), z.unknown()).default({}),
-        idempotencyKey: idempotencyKeySchema,
-        echo: echoSchema,
+    server.tool("askthew_start_signup", {
+        email: z.string().email(),
+        clientHint: z.enum(["claude_code", "codex", "cursor", "web_agent"]).optional(),
     }, async (payload) => {
-        const sessionSignal = redactCodingSessionSignal({
-            ...payload,
-            metadata: {
-                ...runtimeMetadata(options),
-                ...(payload.metadata ?? {}),
-            },
+        const body = await startSignup({
+            email: payload.email,
+            apiUrl: options.apiUrl,
+            clientHint: payload.clientHint,
+            fetcher: options.fetcher,
         });
-        const scopeKey = currentScopeKey();
-        if (mode.mode !== "paid" && localStore) {
-            const loginRequired = requireFreeIdentity();
-            if (loginRequired) {
-                return loginRequired;
-            }
-            const signal = localStore.insertSignal({
-                sessionId: sessionSignal.sessionId,
-                sequence: sessionSignal.sequence,
-                kind: sessionSignal.kind,
-                summary: sessionSignal.summary,
-                evidence: sessionSignal.evidence,
-                filesTouched: sessionSignal.filesTouched,
-                commandsRun: sessionSignal.commandsRun,
-                metadata: sessionSignal.metadata,
-                scopeKey,
-            });
-            const sessionSignalCount = localStore.listSignals({
-                sessionId: signal.sessionId,
-                scopeKey,
-                limit: 100000,
-            }).length;
-            const existingDecision = localStore.getDecisionForSignal(signal.id);
-            const decisionCandidate = candidateFromSignal(signal, existingDecision);
-            const autoDecision = decisionCandidate
-                ? localStore.createDecision({
-                    rawContent: signal.summary,
-                    headline: signal.summary,
-                    status: decisionCandidate.suggestedStatus,
-                    sessionId: signal.sessionId,
-                    files: signal.filesTouched,
-                    sourceSignalIds: [signal.id],
-                    scopeKey,
-                })
-                : null;
-            if (sessionSignal.kind === "final_summary" && mode.cliCredentials) {
-                localStore.enqueueTelemetry(buildTelemetryPayload({
-                    store: localStore,
-                    credentials: mode.cliCredentials,
-                    sessionId: sessionSignal.sessionId,
-                }));
-                void flushTelemetryOutbox({
-                    store: localStore,
-                    credentials: mode.cliCredentials,
-                    apiUrl: options.apiBaseUrl,
-                    fetchImpl: options.fetchImpl,
-                }).catch(() => null);
-            }
-            if (!payload.echo) {
-                return compactWriteResponse({
-                    id: signal.id,
-                    decisionId: autoDecision?.id,
-                    sessionId: signal.sessionId,
-                    sequence: signal.sequence,
-                    signalCount: sessionSignalCount,
-                });
-            }
-            if (payload.echo === "summary") {
-                return localResponse({
-                    ok: true,
-                    id: signal.id,
-                    sessionId: signal.sessionId,
-                    sequence: signal.sequence,
-                    signalCount: sessionSignalCount,
-                    summary: signal.summary,
-                    kind: signal.kind,
-                    ...(autoDecision ? { decisionId: autoDecision.id } : {}),
-                });
-            }
-            return localResponse({
-                ok: true,
-                tier: "free",
-                signal,
-                ...(autoDecision ? { decision: decisionWithSignals(localStore, autoDecision) } : {}),
-                note: localStore.usingJsonFallback
-                    ? "Captured locally in JSON fallback mode because SQLite was unavailable."
-                    : "Captured locally in SQLite. Aggregate telemetry only may flush on final_summary unless opted out.",
-            });
-        }
-        const upstream = await postToServer(payload.echo === "full" ? "/api/ingest/mcp" : withResponseShape("/api/ingest/mcp"), {
-            sessionSignal,
-        }, options, { idempotencyKey: payload.idempotencyKey });
-        const failure = upstreamFailure(upstream);
-        if (failure)
-            return localResponse(failure);
-        if (!payload.echo) {
-            return compactWriteResponse({
-                id: upstreamId(upstream),
-                sessionId: sessionSignal.sessionId,
-                sequence: sessionSignal.sequence,
-                signalCount: upstream && typeof upstream === "object" && typeof upstream.signalCount === "number"
-                    ? upstream.signalCount
-                    : 1,
-            });
-        }
-        if (payload.echo === "summary") {
-            return localResponse({
-                ok: true,
-                id: upstreamId(upstream),
-                sessionId: sessionSignal.sessionId,
-                sequence: sessionSignal.sequence,
-                signalCount: upstream && typeof upstream === "object" && typeof upstream.signalCount === "number"
-                    ? upstream.signalCount
-                    : 1,
-                summary: sessionSignal.summary,
-                kind: sessionSignal.kind,
-            });
-        }
-        return {
-            content: [
-                {
-                    type: "text",
-                    text: JSON.stringify({
-                        ok: true,
-                        signal: sessionSignal,
-                        upstream,
-                        note: "Ask The W stores this as source material and performs inference in the app.",
-                    }, null, 2),
-                },
-            ],
-        };
-    });
-    server.tool("list_decisions", {
-        limit: z.number().int().positive().max(300).optional(),
-        cursor: z.string().optional(),
-        sessionId: z.string().optional(),
-        status: z.enum(["proposed", "committed", "shipped", "abandoned"]).optional(),
-        since: z.string().optional(),
-        compact: z.boolean().optional(),
-        max_chars: maxCharsSchema,
-    }, async (payload) => {
-        if (mode.mode !== "paid" && localStore) {
-            const loginRequired = requireFreeIdentity();
-            if (loginRequired)
-                return loginRequired;
-            const decisions = localStore.listDecisions({
-                limit: payload.limit ?? 5,
-                cursor: payload.cursor,
-                sessionId: payload.sessionId,
-                status: payload.status,
-                since: payload.since,
-                scopeKey: currentScopeKey(),
-            });
-            return budgetedLocalResponse({
-                ok: true,
-                tier: "free",
-                decisions: payload.compact !== false
-                    ? decisions.map((decision) => ({
-                        id: decision.id,
-                        headline: decision.headline,
-                        status: decision.status,
-                        signalIds: decision.sourceSignalIds,
-                    }))
-                    : decisions.map((decision) => decisionWithSignals(localStore, decision)),
-                nextCursor: decisions.length >= (payload.limit ?? 5) ? decisions.at(-1)?.createdAt ?? null : null,
-            }, payload.max_chars ?? 8000);
-        }
-        return apiToolResponse(routeWithQuery("/api/decisions", {
-            limit: payload.limit ?? 5,
-            cursor: payload.cursor,
-            sessionId: payload.sessionId,
-            status: payload.status,
-            since: payload.since,
-            compact: payload.compact ?? true,
-            max_chars: payload.max_chars ?? 8000,
-        }));
+        return toolJson(body);
     });
-    server.tool("get_decision", {
-        id: z.string().min(1),
+    server.tool("askthew_complete_signup", {
+        email: z.string().email(),
+        code: z.string().regex(/^\d{6}$/),
+        clientHint: z.enum(["claude_code", "codex", "cursor", "web_agent"]).optional(),
     }, async (payload) => {
-        if (mode.mode !== "paid" && localStore) {
-            const loginRequired = requireFreeIdentity();
-            if (loginRequired)
-                return loginRequired;
-            const decision = localStore.getDecision(payload.id);
-            return decision
-                ? localResponse({ ok: true, tier: "free", decision: decisionWithSignals(localStore, decision) })
-                : localToolError({
-                    code: "not_found",
-                    message: "Decision not found in the local Ask The W store.",
-                    retryable: false,
-                    hint: "Check the decision id or search/list local decisions first.",
-                });
-        }
-        return apiToolResponse(`/api/decisions/${encodeURIComponent(payload.id)}`);
+        const body = await completeSignup({
+            email: payload.email,
+            code: payload.code,
+            apiUrl: options.apiUrl,
+            clientHint: payload.clientHint,
+            tokenPurpose: "device",
+            fetcher: options.fetcher,
+            env: options.env,
+        });
+        return toolJson(body);
     });
-    server.tool("create_decision", {
-        content: z.string().min(1),
-        idempotencyKey: idempotencyKeySchema,
-        echo: echoSchema,
-    }, async (payload) => {
-        if (mode.mode !== "paid" && localStore) {
-            const loginRequired = requireFreeIdentity();
-            if (loginRequired)
-                return loginRequired;
-            const scopeKey = currentScopeKey();
-            if (payload.idempotencyKey) {
-                const existingId = localStore.getMeta(`idempotency:create_decision:${scopeKey}:${payload.idempotencyKey}`);
-                if (existingId) {
-                    const existing = localStore.getDecision(existingId);
-                    if (existing) {
-                        return payload.echo === "full"
-                            ? localResponse({ ok: true, tier: "free", decision: decisionWithSignals(localStore, existing), idempotent: true })
-                            : compactWriteResponse({ id: existing.id, sequence: localStore.stats().decisions });
-                    }
-                }
-            }
-            const decision = localStore.createDecision({
-                rawContent: payload.content,
-                sessionId: localStore.mostRecentSessionId({ scopeKey }),
-                scopeKey,
-            });
-            if (payload.idempotencyKey) {
-                localStore.setMeta(`idempotency:create_decision:${scopeKey}:${payload.idempotencyKey}`, decision.id);
-            }
-            const warnings = detectDecisionConflicts({
-                decision,
-                decisions: localStore.listDecisions({ limit: 100000, scopeKey }),
+    server.tool("capture_session_signal", codingSessionSignalSchema.shape, async (payload) => {
+        const currentClient = client();
+        if (!currentClient.hasToken())
+            return needsSignup();
+        const parsed = codingSessionSignalSchema.safeParse({
+            ...payload,
+            scopeKey: payload.scopeKey || defaultScopeKey(),
+        });
+        if (!parsed.success) {
+            return toolJson({
+                ok: false,
+                code: "invalid_signal",
+                message: parsed.error.issues.map((issue) => issue.message).join("; "),
             });
-            if (!payload.echo) {
-                return compactWriteResponse({
-                    id: decision.id,
-                    sequence: localStore.stats().decisions,
-                    warnings,
-                });
-            }
-            return localResponse({
+        }
+        const sanitized = redactSignalPayload(parsed.data);
+        const localOutboxId = outbox.append(sanitized);
+        const result = await sendOutboxPayload(currentClient, sanitized);
+        if (result.kind === "sent") {
+            outbox.markSent(localOutboxId);
+            const body = result.body;
+            return toolJson({
                 ok: true,
-                ...(payload.echo === "summary"
-                    ? { id: decision.id, sequence: localStore.stats().decisions, headline: decision.headline, warnings }
-                    : { tier: "free", decision: decisionWithSignals(localStore, decision), warnings }),
+                queued: false,
+                id: body.id,
+                sequence: body.sequence ?? sanitized.sequence,
             });
         }
-        const upstream = await postToServer(payload.echo === "full" ? "/api/decisions" : withResponseShape("/api/decisions"), {
-            content: payload.content,
-        }, options, { method: "POST", idempotencyKey: payload.idempotencyKey });
-        const failure = upstreamFailure(upstream);
-        if (failure)
-            return localResponse(failure);
-        if (!payload.echo) {
-            return compactWriteResponse({
-                id: upstreamId(upstream),
-                sequence: upstreamSequence(upstream) ?? 1,
+        if (result.kind === "failed") {
+            outbox.markFailed(localOutboxId, result.code, result.message);
+            return toolJson({
+                ok: false,
+                code: result.code,
+                message: result.message,
             });
         }
-        return localResponse(payload.echo === "summary"
-            ? { ok: true, id: upstreamId(upstream), sequence: upstreamSequence(upstream) ?? 1 }
-            : upstream);
+        const retryEstimateSeconds = outbox.backoff(localOutboxId, 0, result.retryAfterSeconds);
+        return toolJson({
+            ok: true,
+            queued: true,
+            local_outbox_id: localOutboxId,
+            retry_estimate_seconds: retryEstimateSeconds,
+        });
     });
     server.tool("list_signals", {
-        limit: z.number().int().positive().max(300).optional(),
-        cursor: z.string().optional(),
         sessionId: z.string().optional(),
         since: z.string().optional(),
-        compact: z.boolean().optional(),
-        max_chars: maxCharsSchema,
+        limit: z.number().int().min(1).max(200).default(50),
     }, async (payload) => {
-        if (mode.mode !== "paid" && localStore) {
-            const loginRequired = requireFreeIdentity();
-            if (loginRequired)
-                return loginRequired;
-            const signals = localStore.listSignals({
-                limit: payload.limit ?? 10,
-                cursor: payload.cursor,
-                sessionId: payload.sessionId,
-                since: payload.since,
-                scopeKey: currentScopeKey(),
-            });
-            return budgetedLocalResponse({
-                ok: true,
-                tier: "free",
-                signals: payload.compact !== false
-                    ? signals.map((signal) => compactSignal(signal, localStore.getDecisionForSignal(signal.id)))
-                    : signals.map((signal) => signalWithDecision(localStore, signal)),
-                nextCursor: signals.length >= (payload.limit ?? 10) ? signals.at(-1)?.capturedAt ?? null : null,
-            }, payload.max_chars ?? 8000);
-        }
-        return apiToolResponse(routeWithQuery("/api/signals", {
-            limit: payload.limit ?? 10,
-            cursor: payload.cursor,
-            sessionId: payload.sessionId,
-            since: payload.since,
-            compact: payload.compact ?? true,
-            max_chars: payload.max_chars ?? 8000,
-        }));
+        const currentClient = client();
+        if (!currentClient.hasToken())
+            return needsSignup();
+        const result = await currentClient.listSignals(payload);
+        return toolJson(result.body);
     });
-    server.tool("recap", "Get a concise recap of the latest local coding-agent session.", {
-        format: z.enum(["digest", "standup", "share"]).default("digest"),
-        sessionId: z.string().optional(),
-        compact: z.boolean().optional(),
-        max_chars: maxCharsSchema,
-    }, async (payload) => {
-        if (!localStore || mode.mode === "paid")
-            return localResponse(paidFeatureNudge("recap"));
-        const loginRequired = requireFreeIdentity();
-        if (loginRequired)
-            return loginRequired;
-        const limited = consumeLimitedLocalUse("recap");
-        if (limited)
-            return limited;
-        const scopeKey = currentScopeKey();
-        const sessionId = payload.sessionId ?? localStore.mostRecentSessionId({ scopeKey });
-        const signals = sessionId ? localStore.listSignals({ sessionId, scopeKey, limit: 100000 }) : [];
-        const decisions = sessionId ? localStore.listDecisions({ sessionId, scopeKey, limit: 100000 }) : [];
-        return budgetedLocalResponse({
-            ok: true,
-            tier: "free",
-            sessionId,
-            format: payload.format,
-            rendered: renderRecap({ format: payload.format, signals, decisions }),
-            ...(payload.compact
-                ? { signals: signals.map((signal) => compactSignal(signal, localStore.getDecisionForSignal(signal.id))) }
-                : {}),
-        }, payload.max_chars);
+    server.tool("create_decision", decisionSchema.shape, async (payload) => {
+        const currentClient = client();
+        if (!currentClient.hasToken())
+            return needsSignup();
+        const result = await currentClient.createDecision(payload);
+        return toolJson(result.body);
     });
-    server.tool("coach", "Get one concise coaching nudge for the local coding-agent session.", {
-        sessionId: z.string().optional(),
-        max_chars: maxCharsSchema,
+    server.tool("list_decisions", {
+        limit: z.number().int().min(1).max(200).default(50),
     }, async (payload) => {
-        if (!localStore || mode.mode === "paid")
-            return localResponse(paidFeatureNudge("coach"));
-        const loginRequired = requireFreeIdentity();
-        if (loginRequired)
-            return loginRequired;
-        const limited = consumeLimitedLocalUse("coach");
-        if (limited)
-            return limited;
-        const scopeKey = currentScopeKey();
-        const sessionId = payload.sessionId ?? localStore.mostRecentSessionId({ scopeKey });
-        const signals = sessionId ? localStore.listSignals({ sessionId, scopeKey, limit: 100000 }) : [];
-        const decisions = sessionId ? localStore.listDecisions({ sessionId, scopeKey, limit: 100000 }) : [];
-        const coaching = buildSessionCoach({ signals, decisions });
-        return budgetedLocalResponse({
-            ok: true,
-            tier: "free",
-            sessionId,
-            nudge: coaching.nudge,
-            rendered: coaching.nudge,
-        }, payload.max_chars);
+        const currentClient = client();
+        if (!currentClient.hasToken())
+            return needsSignup();
+        const result = await currentClient.listDecisions(payload);
+        return toolJson(result.body);
     });
-    server.tool("promote_signal_to_decision", "Copy a captured signal summary into a linked local decision.", {
-        signalId: z.union([z.string(), z.number()]),
-        status: z.enum(["proposed", "committed", "shipped", "abandoned"]).default("proposed"),
-        why: z.string().optional(),
-        idempotencyKey: idempotencyKeySchema,
+    server.tool("recap", {
+        since: z.string().optional(),
+        maxSignals: z.number().int().min(1).max(200).optional(),
     }, async (payload) => {
-        if (!localStore || mode.mode === "paid")
-            return localResponse(paidFeatureNudge("promote_signal_to_decision"));
-        const loginRequired = requireFreeIdentity();
-        if (loginRequired)
-            return loginRequired;
-        const numericSignalId = typeof payload.signalId === "number" ? payload.signalId : Number(payload.signalId);
-        if (!Number.isFinite(numericSignalId)) {
-            return localToolError({
-                code: "invalid_input",
-                message: "Invalid signalId.",
-                retryable: false,
-                hint: "Use the numeric local signal id.",
-                extra: { field: "signalId" },
-            });
-        }
-        const signal = localStore.getSignal(numericSignalId);
-        if (!signal) {
-            return localToolError({
-                code: "not_found",
-                message: "Signal not found in the local Ask The W store.",
-                retryable: false,
-                hint: "List signals first, then pass the numeric local signal id.",
-                extra: { tool: "promote_signal_to_decision" },
-            });
+        const currentClient = client();
+        if (!currentClient.hasToken())
+            return needsSignup();
+        try {
+            const result = await currentClient.recap(payload);
+            return toolJson(result.body);
         }
-        const linkedDecision = localStore.getDecisionForSignal(signal.id);
-        if (linkedDecision) {
-            const decision = localStore.updateDecision(linkedDecision.id, {
-                ...(payload.why !== undefined ? { why: payload.why } : {}),
-                status: payload.status,
-            }) ?? linkedDecision;
-            return localResponse({
-                ok: true,
-                id: decision.id,
-                sequence: localStore.stats().decisions,
-                decision: decisionWithSignals(localStore, decision),
-                linkedSignalId: signal.id,
-                reused: true,
+        catch {
+            return toolJson({
+                ok: false,
+                code: "unreachable",
+                message: "Couldn't reach Ask The W. Captures are queued; recap will be available when you're back online.",
             });
         }
-        if (payload.idempotencyKey) {
-            const existingId = localStore.getMeta(`idempotency:promote_signal_to_decision:${payload.idempotencyKey}`);
-            if (existingId) {
-                const existing = localStore.getDecision(existingId);
-                if (existing) {
-                    return localResponse({
-                        ok: true,
-                        id: existing.id,
-                        sequence: localStore.stats().decisions,
-                        decision: decisionWithSignals(localStore, existing),
-                        linkedSignalId: signal.id,
-                        idempotent: true,
-                    });
-                }
-            }
-        }
-        const decision = localStore.createDecision({
-            rawContent: signal.summary,
-            headline: signal.summary,
-            why: payload.why ?? null,
-            status: payload.status,
-            sessionId: signal.sessionId,
-            files: signal.filesTouched,
-            sourceSignalIds: [signal.id],
-            scopeKey: signal.scopeKey ?? currentScopeKey(),
-        });
-        if (payload.idempotencyKey) {
-            localStore.setMeta(`idempotency:promote_signal_to_decision:${payload.idempotencyKey}`, decision.id);
-        }
-        const warnings = detectDecisionConflicts({
-            decision,
-            decisions: localStore.listDecisions({ limit: 100000, scopeKey: decision.scopeKey }),
-        });
-        return localResponse({
-            ok: true,
-            id: decision.id,
-            sequence: localStore.stats().decisions,
-            decision: decisionWithSignals(localStore, decision),
-            linkedSignalId: signal.id,
-            warnings,
-        });
     });
-    return server;
-}
-function buildSessionCoach(input) {
-    const verificationCount = input.signals.filter((signal) => signal.kind === "verification_result").length;
-    const implementationCount = input.signals.filter((signal) => signal.kind === "implementation_update").length;
-    const directionCount = input.signals.filter((signal) => signal.kind === "direction_change").length;
-    const finalSummaryCount = input.signals.filter((signal) => signal.kind === "final_summary").length;
-    const decisionCount = input.decisions.length;
-    const hasVerification = verificationCount > 0;
-    const hasDecision = decisionCount > 0;
-    const hasDirection = directionCount > 0;
-    const nudge = implementationCount >= 3 && verificationCount === 0
-        ? `You captured ${implementationCount} implementation updates but no verification_result; run one check and capture it before ending.`
-        : input.signals.length >= 6 && finalSummaryCount === 0
-            ? `You captured ${input.signals.length} signals but no final_summary; close the session with the outcome and remaining risk.`
-            : decisionCount === 0 && directionCount > 0
-                ? "Direction changed, but no decision was captured; promote the clearest direction_change signal."
-                : !hasDecision
-                    ? "Promote the clearest captured signal into a decision before the trail goes stale."
-                    : !hasVerification
-                        ? "Capture one verification result so the decision trail records whether the work actually held."
-                        : implementationCount > decisionCount * 3
-                            ? "There are many implementation updates per decision; collapse the important why into one decision."
-                            : "The trail is usable. Keep the next decision tied to a verification result.";
-    return { nudge };
-}
-function decisionalWeight(signal) {
-    const kindWeight = signal.kind === "direction_change" ? 4 : signal.kind === "verification_result" ? 3 : signal.kind === "implementation_update" ? 2 : 1;
-    const textWeight = /\b(decid|chose|commit|reject|approve|ship|verify|blocked|risk)\b/i.test(signal.summary) ? 2 : 0;
-    return kindWeight + textWeight;
-}
-function renderRecap(input) {
-    if (input.format === "standup") {
-        const blockers = input.signals.filter((signal) => /\b(block|fail|error|risk|stuck)\b/i.test(signal.summary));
-        return [
-            "# Standup Recap",
-            "## Yesterday",
-            input.decisions.length ? `- Captured ${input.decisions.length} decisions.` : "- No decisions captured.",
-            "## Today",
-            input.signals.length ? `- Review ${input.signals.length} session signals and promote the strongest one.` : "- Capture the first useful signal.",
-            "## Blockers",
-            ...(blockers.length ? blockers.slice(0, 5).map((signal) => `- ${signal.summary}`) : ["- None captured."]),
-        ].join("\n");
-    }
-    if (input.format === "share") {
-        return [
-            "# Ask The W Session Share",
-            "",
-            `Signals captured: ${input.signals.length}`,
-            `Decisions captured: ${input.decisions.length}`,
-            "",
-            "## Highlights",
-            ...input.signals
-                .slice()
-                .sort((left, right) => decisionalWeight(right) - decisionalWeight(left))
-                .slice(0, 8)
-                .map((signal) => `- ${signal.summary}`),
-            "",
-            "_Captured by Ask The W._",
-        ].join("\n");
-    }
-    return [
-        "# Session Digest",
-        "",
-        ...input.signals
-            .slice()
-            .sort((left, right) => decisionalWeight(right) - decisionalWeight(left))
-            .slice(0, 28)
-            .map((signal, index) => `${index + 1}. [${signal.kind}] ${signal.summary}`),
-    ].join("\n").split("\n").slice(0, 30).join("\n");
-}
-function renderSessionFeed(signals) {
-    if (signals.length === 0) {
-        return "# Session\n\nNo local signals captured yet.";
-    }
-    return [
-        "# Session",
-        "",
-        ...signals.map((signal) => [
-            `## ${signal.sequence ?? signal.id}. ${signal.kind}`,
-            signal.summary,
-            `- captured: ${signal.capturedAt}`,
-            signal.filesTouched.length ? `- files: ${signal.filesTouched.join(", ")}` : "- files: none",
-            signal.commandsRun.length ? `- commands: ${signal.commandsRun.join(" | ")}` : "- commands: none",
-        ].join("\n")),
-    ].join("\n\n");
-}
-function compactSignal(signal, decision) {
-    return {
-        id: signal.id,
-        kind: signal.kind,
-        summary: signal.summary,
-        files: signal.filesTouched,
-        decisionId: decision?.id ?? null,
-    };
-}
-function decisionWithSignals(store, decision) {
-    return {
-        ...decision,
-        contributingSignals: store.listSignalsByIds(decision.sourceSignalIds),
-    };
-}
-function signalWithDecision(store, signal) {
-    const decision = store.getDecisionForSignal(signal.id);
-    return {
-        ...signal,
-        decisionId: decision?.id ?? null,
-        decision: decision
-            ? {
-                id: decision.id,
-                headline: decision.headline,
-                status: decision.status,
-                why: decision.why,
-            }
-            : null,
-    };
-}
-function candidateFromSignal(signal, linkedDecision) {
-    if (linkedDecision)
-        return null;
-    const text = [signal.summary, ...signal.evidence.map((entry) => {
-            if (entry && typeof entry === "object") {
-                const record = entry;
-                return [record.excerpt, record.diff, record.before, record.after].filter(Boolean).join(" ");
-            }
-            return String(entry ?? "");
-        })].join(" ");
-    const hasDecisionLanguage = /\b(decid(?:e|ed|ing)?|chose|choose|commit(?:ted)?|approved?|reject(?:ed)?|let'?s go with|go with|we will|we're going to|standardize|adopt|defer|drop|keep|remove|replace)\b/i.test(text);
-    if (!hasDecisionLanguage && signal.kind !== "direction_change") {
-        return null;
-    }
-    const because = /\bbecause\b/i.test(text);
-    return {
-        id: `candidate_${signal.id}`,
-        signalId: signal.id,
-        sessionId: signal.sessionId,
-        summary: signal.summary,
-        suggestedStatus: signal.kind === "verification_result" ? "shipped" : "proposed",
-        why: because ? "The signal includes an explicit because/reason clause." : "The signal uses decision language.",
-        files: signal.filesTouched,
-        capturedAt: signal.capturedAt,
-    };
-}
-function normalizedDecisionTerms(text) {
-    const stop = new Set(["the", "and", "for", "with", "this", "that", "from", "into", "keep", "use", "adopt", "remove", "drop", "replace", "defer", "ship", "commit"]);
-    return String(text ?? "")
-        .toLowerCase()
-        .replace(/[^a-z0-9\s-]/g, " ")
-        .split(/\s+/)
-        .filter((term) => term.length >= 4 && !stop.has(term));
-}
-function decisionPolarity(text) {
-    if (/\b(remove|drop|abandon|defer|reject|disable|stop|sunset|do not|don't|won't|will not)\b/i.test(text))
-        return "negative";
-    if (/\b(keep|use|adopt|enable|add|ship|commit|standardize|choose|approve|go with)\b/i.test(text))
-        return "positive";
-    return "neutral";
-}
-function detectDecisionConflicts(input) {
-    const polarity = decisionPolarity(`${input.decision.headline} ${input.decision.rawContent}`);
-    if (polarity === "neutral")
-        return [];
-    const terms = new Set(normalizedDecisionTerms(`${input.decision.headline} ${input.decision.rawContent}`));
-    if (terms.size === 0)
-        return [];
-    return input.decisions
-        .filter((prior) => prior.id !== input.decision.id)
-        .filter((prior) => !input.decision.scopeKey || prior.scopeKey === input.decision.scopeKey)
-        .map((prior) => {
-        const priorPolarity = decisionPolarity(`${prior.headline} ${prior.rawContent}`);
-        const priorTerms = normalizedDecisionTerms(`${prior.headline} ${prior.rawContent}`);
-        const overlap = priorTerms.filter((term) => terms.has(term));
-        return {
-            prior,
-            priorPolarity,
-            overlap,
-        };
-    })
-        .filter((entry) => entry.priorPolarity !== "neutral" && entry.priorPolarity !== polarity && entry.overlap.length > 0)
-        .slice(0, 3)
-        .map((entry) => ({
-        code: "possible_conflict",
-        message: `This may conflict with "${entry.prior.headline}".`,
-        conflictingDecisionId: entry.prior.id,
-        overlappingTerms: entry.overlap.slice(0, 5),
-    }));
-}
-const isDirectIndexExecution = Boolean(process.argv[1]) &&
-    (() => {
-        const modulePath = fileURLToPath(import.meta.url);
-        const invokedPath = path.resolve(process.argv[1]);
+    server.tool("coach", {
+        focus: z.string().max(1000).optional(),
+    }, async (payload) => {
+        const currentClient = client();
+        if (!currentClient.hasToken())
+            return needsSignup();
         try {
-            return fs.realpathSync(invokedPath) === fs.realpathSync(modulePath);
+            const result = await currentClient.coach(payload);
+            return toolJson(result.body);
         }
         catch {
-            return invokedPath === modulePath;
+            return toolJson({
+                ok: false,
+                code: "unreachable",
+                message: "Couldn't reach Ask The W. Captures are queued; coach will be available when you're back online.",
+            });
         }
-    })();
-export async function runInitializeHandshake(input = {}) {
-    const modulePath = input.entrypoint ?? fileURLToPath(import.meta.url);
-    const child = spawn(process.execPath, [modulePath], {
-        cwd: process.cwd(),
-        env: input.env ?? process.env,
-        stdio: ["pipe", "pipe", "pipe"],
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.setEncoding("utf8");
-    child.stderr.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-        stdout += chunk;
     });
-    child.stderr.on("data", (chunk) => {
-        stderr += chunk;
-    });
-    const initialize = {
-        jsonrpc: "2.0",
-        id: 1,
-        method: "initialize",
-        params: {
-            protocolVersion: "2024-11-05",
-            capabilities: {},
-            clientInfo: { name: "askthew-initialize-handshake", version: "1.0.0" },
-        },
-    };
-    child.stdin.write(`${JSON.stringify(initialize)}\n`);
-    try {
-        return await new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => {
-                reject(new Error(`Timed out waiting for initialize response. stdout=${stdout} stderr=${stderr}`));
-            }, input.timeoutMs ?? 3000);
-            const failOnExit = (code) => {
-                clearTimeout(timeout);
-                reject(new Error(`MCP stdio server exited before initialize. code=${code} stdout=${stdout} stderr=${stderr}`));
-            };
-            const check = () => {
-                const lineEnd = stdout.indexOf("\n");
-                if (lineEnd === -1)
-                    return;
-                clearTimeout(timeout);
-                child.off("exit", failOnExit);
-                const response = JSON.parse(stdout.slice(0, lineEnd));
-                if (response.id !== 1 || response.jsonrpc !== "2.0" || !response.result) {
-                    reject(new Error(`Unexpected initialize response: ${JSON.stringify(response)}`));
-                    return;
-                }
-                resolve({
-                    serverInfoVersion: typeof response.result?.serverInfo?.version === "string"
-                        ? response.result.serverInfo.version
-                        : undefined,
-                });
-            };
-            child.stdout.on("data", check);
-            child.once("exit", failOnExit);
-            check();
-        });
-    }
-    finally {
-        child.kill();
-    }
+    return server;
 }
-if (isDirectIndexExecution) {
-    if (process.argv[2] === "initialize-handshake") {
-        runInitializeHandshake()
-            .then(() => {
-            console.log("Ask The W MCP initialize handshake succeeded.");
-        })
-            .catch((error) => {
-            if (error instanceof Error) {
-                console.error(error.message);
-            }
-            else {
-                console.error("Ask The W MCP initialize handshake failed.", error);
-            }
-            process.exit(1);
-        });
-    }
-    else {
-        const server = createAskTheWMcpServer();
-        const transport = new StdioServerTransport();
-        server.connect(transport).catch((error) => {
-            if (error instanceof Error) {
-                console.error(error.message);
-            }
-            else {
-                console.error("Ask The W MCP server failed to start.", error);
-            }
-            process.exit(1);
-        });
-    }
+export async function runStdioServer(options = {}) {
+    const server = createAskTheWMcpServer(options);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
 }