@compilr-dev/sdk 0.24.0 → 0.24.2

package/dist/guide/shared-content.js

@@ -44,12 +44,12 @@ After creation, the project is set as active and agents can start working in it.
         content: `Each project type determines which agent roles, skills, and tools are most relevant:
 
 **software** — Agent roles: dev, pm, qa, arch. Skills: /design, /prd, /architecture, /scaffold, /build
-**research** — Agent roles: researcher, reviewer, writer. Skills: /outline, /literature-review, /methodology, /abstract
-**book** — Agent roles: editor, writer, reviewer. Skills: /outline, /chapter
-**course** — Agent roles: instructor, writer, reviewer. Skills: /outline, /lesson
-**business-plan** — Agent roles: analyst, strategist, writer. Skills: /business-vision, /market-analysis, /financial-model, /pitch
-**content-marketing** — Agent roles: writer, editor, strategist. Skills: /editorial-calendar, /article
-**tech-docs** — Agent roles: writer, dev, reviewer. Skills: /getting-started, /api-reference, /tutorial
+**research** — Agent roles: researcher, reviewer, writer. Skills: /research-scaffold, /outline, /literature-review, /draft-section, /peer-review
+**book** — Agent roles: editor, writer, reviewer. Skills: /book-outline, /character-design, /plot-threads, /scene-breakdown, /book-review
+**course** — Agent roles: instructor, writer, reviewer. Skills: /curriculum-design, /lesson-plan, /assessment-design, /course-review
+**business-plan** — Agent roles: analyst, strategist, writer. Skills: /business-vision, /market-analysis, /competitor-analysis, /financial-model, /pitch-outline, /business-review
+**content-marketing** — Agent roles: writer, editor, strategist. Skills: /content-strategy, /content-calendar, /create-content, /content-review, /brand-setup
+**tech-docs** — Agent roles: writer, dev, reviewer. Skills: /outline, /draft-section, /peer-review
 
 All project types support: teams, backlog, documents, knowledge base, file references, anchors.`,
     },
@@ -122,11 +122,11 @@ The delegated agent runs independently and returns results to the coordinator.`,
 
 Use them by typing / followed by the skill name (e.g., /design, /build).
 
-Skills vary by project type. Software projects have: /design, /prd, /architecture, /scaffold, /build, /backlog, /session-notes.
+Skills vary by project type. Software projects have: /design, /sketch, /prd, /architecture, /scaffold, /build, /refine, /session-notes.
 
-Research projects have: /outline, /literature-review, /methodology, /abstract.
+Research projects have: /research-scaffold, /outline, /literature-review, /draft-section, /peer-review.
 
-Business projects have: /business-vision, /market-analysis, /financial-model, /pitch.
+Business projects have: /business-vision, /market-analysis, /competitor-analysis, /financial-model, /pitch-outline, /business-review.
 
 Skills can be combined with your own instructions: type /design then add context.`,
     },

package/dist/index.d.ts

@@ -39,7 +39,7 @@ export { AgentTeam, TeamAgent, SharedContextManager, ArtifactStore, DelegationTr
 export type { AgentTeamConfig, TeamAgentConfig, TeamAgentUpdate, AgentUpdateResult, ITeamPersistence, IArtifactStorage, ISessionRegistry, CustomAgentDefinition, AgentTemplate, AgentWorkshopData, WorkshopRoleDef, WorkshopToolProfile, WorkshopModelTier, WorkshopSkillDef, PlanSubmitInfo, PlanSubmitResult, PlanModeExitInfo, PlanModeCallbacks, ToolConfig as TeamToolConfig, ToolTier, ToolGroup, ProfileInfo, } from './team/index.js';
 export type { AgentRole, RoleMetadata, ToolProfile, MascotExpression, BackgroundSessionInfo, SerializedTeam, SerializedTeamAgent, TeamMetadata, TeamEvent, TeamEventType, TeamEventHandler, Artifact, ArtifactType as TeamArtifactType, ArtifactSummary as TeamArtifactSummary, CreateArtifactOptions, UpdateArtifactOptions, SerializedArtifact, SharedContext, SharedProjectInfo, SharedTeamInfo, TeamRosterEntry, TeamActivity, TeamActivityType, SharedDecision, TokenBudget, SerializedSharedContext, ParsedMention, ParsedInput, ResolvedMention, ResolveOptions, ResolutionSource, Delegation, DelegationStatus, DelegationResult, CompletionEvent, CreateDelegationOptions, DelegationStats, DelegationTrackerEvents, HandoffResult, HandoffToolConfig, HandoffIntent, HandoffValidationResult, DelegateResult, DelegateToolConfig, DelegateBackgroundResult, DelegateBackgroundToolConfig, ConsultInput, ConsultResult, ConsultToolConfig, NormalizedRole, SkillToolRequirement, } from './team/index.js';
 export { ROLE_METADATA, ROLE_EXPERTISE, ROLE_GROUPS, PREDEFINED_ROLE_IDS, TOOL_GROUPS, TOOL_PROFILES, PROFILE_INFO, SKILL_REQUIREMENTS, CUSTOM_MASCOTS, buildAgentWorkshopData, buildSuggestedRolesMap, PLAN_MODE_BLOCKED_TOOLS, PLAN_MODE_DENIAL_MESSAGE, PLAN_MODE_PROMPT, isToolAllowedInPlanMode, getPlanModePrompt, } from './team/index.js';
-export { getToolsForProfile, detectProfileFromTools, isProfileReadOnly, generateToolAwarenessPrompt, generateCoordinatorGuidance, generateSpecialistGuidance, createDefaultToolConfig, validateToolConfig, getAllGroupIds, getGroupInfo, getGroupsByTier, getGroupsForProfile, assignMascot, generateCustomAgentSystemPrompt, getCustomAgentToolFilter, getCustomAgentProfileLabel, validateAgentId, isAgentIdTaken, createCustomAgentDefinition, listTemplates, getTemplate, saveTemplate, updateTemplate, deleteTemplate, createAgentFromTemplate, parseInputForMentions, getReferencedAgents, hasReferences, buildMessageWithContext, buildContextMap, findAgentForRole, findAgentById, getAvailableSpecialists, getSpecialistsSummary, hasSpecialists, suggestOwner, suggestOwners, matchesAgentExpertise, wouldCreateLoop, recordAssignment, getAssignmentHistory, clearAssignmentHistory, clearAllAssignmentHistory, canReassign, resolveAgentIdCollision, setActiveSharedContext, getActiveSharedContext, recordTeamActivity, getDefinedSkillNames, getSkillRequirements, checkSkillCompatibility, getCompatibleSkills, getAllRequiredTools, getSkillsByCategory, } from './team/index.js';
+export { getToolsForProfile, detectProfileFromTools, isProfileReadOnly, generateToolAwarenessPrompt, generateCoordinatorGuidance, generateSpecialistGuidance, createDefaultToolConfig, validateToolConfig, getAllGroupIds, getGroupInfo, getGroupsByTier, getGroupsForProfile, assignMascot, generateCustomAgentSystemPrompt, mcpServerOf, filterMcpToolsByGrant, MCP_TOOL_PREFIX, getCustomAgentToolFilter, getCustomAgentProfileLabel, validateAgentId, isAgentIdTaken, createCustomAgentDefinition, listTemplates, getTemplate, saveTemplate, updateTemplate, deleteTemplate, createAgentFromTemplate, parseInputForMentions, getReferencedAgents, hasReferences, buildMessageWithContext, buildContextMap, findAgentForRole, findAgentById, getAvailableSpecialists, getSpecialistsSummary, hasSpecialists, suggestOwner, suggestOwners, matchesAgentExpertise, wouldCreateLoop, recordAssignment, getAssignmentHistory, clearAssignmentHistory, clearAllAssignmentHistory, canReassign, resolveAgentIdCollision, setActiveSharedContext, getActiveSharedContext, recordTeamActivity, getDefinedSkillNames, getSkillRequirements, checkSkillCompatibility, getCompatibleSkills, getAllRequiredTools, getSkillsByCategory, } from './team/index.js';
 export { codingPreset, readOnlyPreset, resolvePreset } from './presets/index.js';
 export type { Preset } from './presets/index.js';
 export type { AnyTool } from './presets/types.js';

package/dist/index.js

@@ -53,7 +53,7 @@ getToolsForProfile, detectProfileFromTools, isProfileReadOnly, generateToolAware
 // Tool config (extended)
 createDefaultToolConfig, validateToolConfig, getAllGroupIds, getGroupInfo, getGroupsByTier, getGroupsForProfile, 
 // Custom agents
-assignMascot, generateCustomAgentSystemPrompt, getCustomAgentToolFilter, getCustomAgentProfileLabel, validateAgentId, isAgentIdTaken, createCustomAgentDefinition, 
+assignMascot, generateCustomAgentSystemPrompt, mcpServerOf, filterMcpToolsByGrant, MCP_TOOL_PREFIX, getCustomAgentToolFilter, getCustomAgentProfileLabel, validateAgentId, isAgentIdTaken, createCustomAgentDefinition, 
 // Agent templates
 listTemplates, getTemplate, saveTemplate, updateTemplate, deleteTemplate, createAgentFromTemplate, 
 // Mention parsing

package/dist/skills/types.d.ts

@@ -77,8 +77,14 @@ export interface CustomSkill {
  *   /skill fork <name>   →  clone under a new name
  *   /skill bind <cmd>    →  remap slash command to a custom skill
  *
- * This list is the union of all platform-skill names exported by
- * platform-skills.ts. Keep it in sync when adding new SDK skills.
+ * ⚠️ DERIVED, NOT MAINTAINED. This used to be a hand-written list with a comment saying "keep
+ * it in sync when adding new SDK skills". It drifted: 34 entries against 42 platform skills,
+ * missing the entire canvas family — so `/skill new canvas` was accepted, the user's skill
+ * silently outranked the SDK's (project and user scope beat sdk in `resolveSkillPrompt`), and
+ * the collision detector stayed quiet because it only warns about names it knows are reserved.
+ *
+ * A second copy of a list is a list that will disagree with the first. Deriving it costs one
+ * import and cannot go stale.
  */
 export declare const RESERVED_SKILL_NAMES: readonly string[];
 export declare function isReservedSkillName(name: string): boolean;

package/dist/skills/types.js

@@ -9,6 +9,7 @@
  * extensions live under the optional `compilr:` block, which
  * Anthropic-compatible runtimes ignore.
  */
+import { platformSkills } from './platform-skills.js';
 /**
  * SDK skill names that are reserved — user/project skills cannot use these.
  *
@@ -17,51 +18,16 @@
  *   /skill fork <name>   →  clone under a new name
  *   /skill bind <cmd>    →  remap slash command to a custom skill
  *
- * This list is the union of all platform-skill names exported by
- * platform-skills.ts. Keep it in sync when adding new SDK skills.
+ * ⚠️ DERIVED, NOT MAINTAINED. This used to be a hand-written list with a comment saying "keep
+ * it in sync when adding new SDK skills". It drifted: 34 entries against 42 platform skills,
+ * missing the entire canvas family — so `/skill new canvas` was accepted, the user's skill
+ * silently outranked the SDK's (project and user scope beat sdk in `resolveSkillPrompt`), and
+ * the collision detector stayed quiet because it only warns about names it knows are reserved.
+ *
+ * A second copy of a list is a list that will disagree with the first. Deriving it costs one
+ * import and cannot go stale.
  */
-export const RESERVED_SKILL_NAMES = [
-    // Software (9)
-    'design',
-    'sketch',
-    'prd',
-    'refine',
-    'refine-item',
-    'architecture',
-    'session-notes',
-    'build',
-    'scaffold',
-    // Research (5)
-    'outline',
-    'literature-review',
-    'draft-section',
-    'peer-review',
-    'research-scaffold',
-    // Business (6)
-    'business-vision',
-    'market-analysis',
-    'competitor-analysis',
-    'financial-model',
-    'pitch-outline',
-    'business-review',
-    // Content (5)
-    'brand-setup',
-    'content-strategy',
-    'content-calendar',
-    'create-content',
-    'content-review',
-    // Course (4)
-    'curriculum-design',
-    'lesson-plan',
-    'assessment-design',
-    'course-review',
-    // Book (5)
-    'book-outline',
-    'character-design',
-    'plot-threads',
-    'scene-breakdown',
-    'book-review',
-];
+export const RESERVED_SKILL_NAMES = platformSkills.map((s) => s.name);
 export function isReservedSkillName(name) {
     return RESERVED_SKILL_NAMES.includes(name);
 }

package/dist/team/index.d.ts

@@ -7,6 +7,7 @@
 export { AgentTeam } from './team.js';
 export type { AgentTeamConfig } from './team.js';
 export { TeamAgent, isNarrowing, lostWriteAccess } from './team-agent.js';
+export { mcpServerOf, filterMcpToolsByGrant, MCP_TOOL_PREFIX } from './mcp-servers.js';
 export type { TeamAgentUpdate, AgentUpdateResult } from './team-agent.js';
 export { SharedContextManager } from './shared-context.js';
 export type { SharedContext, SharedProjectInfo, SharedTeamInfo, TeamRosterEntry, TeamActivity, TeamActivityType, SharedDecision, TokenBudget, SerializedSharedContext, } from './shared-context.js';

package/dist/team/index.js

@@ -7,6 +7,7 @@
 // Core classes
 export { AgentTeam } from './team.js';
 export { TeamAgent, isNarrowing, lostWriteAccess } from './team-agent.js';
+export { mcpServerOf, filterMcpToolsByGrant, MCP_TOOL_PREFIX } from './mcp-servers.js';
 export { SharedContextManager } from './shared-context.js';
 export { ArtifactStore } from './artifacts.js';
 export { ROLE_METADATA, ROLE_EXPERTISE, ROLE_GROUPS, PREDEFINED_ROLE_IDS } from './types.js';

package/dist/team/mcp-servers.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Which MCP server owns a tool.
+ *
+ * `MCPManager` names every discovered tool `` `${prefix}_${server}_${tool}` `` (default prefix
+ * `mcp`). Recovering the server from the name is what lets a host honour a per-agent grant, and
+ * it is shared here because BOTH hosts need it and a second copy would eventually disagree with
+ * the first about which server owns `mcp_my_db_replica_list_tables`.
+ */
+/** The prefix `MCPManager` is constructed with in both hosts. */
+export declare const MCP_TOOL_PREFIX = "mcp";
+/**
+ * The server a tool belongs to, or `null` when it cannot be told.
+ *
+ * ⚠️ DO NOT SPLIT ON `_`. Server names and tool names may both contain underscores, so
+ * `mcp_my_db_replica_list_tables` splits four ways and only one reading is right. Matching
+ * against the manager's own server list, LONGEST FIRST, is the only approach that cannot assign
+ * a tool to a server the user did not grant — `my_db` is a prefix of `my_db_replica`, and
+ * checking it first would hand the replica's tools to the wrong server.
+ *
+ * ⚠️ `null` MEANS "DO NOT GUESS", NOT "DENY". A caller should leave an unidentifiable tool
+ * alone: removing a capability because a name did not parse is a failure the user cannot see or
+ * act on, and the names come from servers we do not control.
+ */
+export declare function mcpServerOf(toolName: string, servers: readonly string[], prefix?: string): string | null;
+/**
+ * Filter MCP tools down to what an agent is granted.
+ *
+ * The shared half of enforcement: a host still decides WHEN to call it (at construction, where
+ * a tool the agent does not have cannot be called at all), but not what an absent grant means
+ * or how a tool maps to a server.
+ */
+export declare function filterMcpToolsByGrant<T extends {
+    definition: {
+        name: string;
+    };
+}>(tools: readonly T[], servers: readonly string[], grants: (server: string) => boolean, prefix?: string): T[];

package/dist/team/mcp-servers.js

@@ -0,0 +1,44 @@
+/**
+ * Which MCP server owns a tool.
+ *
+ * `MCPManager` names every discovered tool `` `${prefix}_${server}_${tool}` `` (default prefix
+ * `mcp`). Recovering the server from the name is what lets a host honour a per-agent grant, and
+ * it is shared here because BOTH hosts need it and a second copy would eventually disagree with
+ * the first about which server owns `mcp_my_db_replica_list_tables`.
+ */
+/** The prefix `MCPManager` is constructed with in both hosts. */
+export const MCP_TOOL_PREFIX = 'mcp';
+/**
+ * The server a tool belongs to, or `null` when it cannot be told.
+ *
+ * ⚠️ DO NOT SPLIT ON `_`. Server names and tool names may both contain underscores, so
+ * `mcp_my_db_replica_list_tables` splits four ways and only one reading is right. Matching
+ * against the manager's own server list, LONGEST FIRST, is the only approach that cannot assign
+ * a tool to a server the user did not grant — `my_db` is a prefix of `my_db_replica`, and
+ * checking it first would hand the replica's tools to the wrong server.
+ *
+ * ⚠️ `null` MEANS "DO NOT GUESS", NOT "DENY". A caller should leave an unidentifiable tool
+ * alone: removing a capability because a name did not parse is a failure the user cannot see or
+ * act on, and the names come from servers we do not control.
+ */
+export function mcpServerOf(toolName, servers, prefix = MCP_TOOL_PREFIX) {
+    const byLongest = [...servers].sort((a, b) => b.length - a.length);
+    for (const server of byLongest) {
+        if (toolName.startsWith(`${prefix}_${server}_`))
+            return server;
+    }
+    return null;
+}
+/**
+ * Filter MCP tools down to what an agent is granted.
+ *
+ * The shared half of enforcement: a host still decides WHEN to call it (at construction, where
+ * a tool the agent does not have cannot be called at all), but not what an absent grant means
+ * or how a tool maps to a server.
+ */
+export function filterMcpToolsByGrant(tools, servers, grants, prefix = MCP_TOOL_PREFIX) {
+    return tools.filter((tool) => {
+        const server = mcpServerOf(tool.definition.name, servers, prefix);
+        return server === null || grants(server);
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@compilr-dev/sdk",
-  "version": "0.24.0",
+  "version": "0.24.2",
   "description": "Universal agent runtime for building AI-powered applications",
   "type": "module",
   "main": "dist/index.js",