@de-otio/repo-aegis-mcp 0.2.0

package/dist/tools/audit.js

@@ -0,0 +1,317 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Richard Myers and contributors.
+import { execFileSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+import { z } from "zod";
+import { computeDenySet, readRepoConfig, scanFile, } from "@de-otio/repo-aegis-core";
+import { jsonResult } from "./_util.js";
+/**
+ * Hard-coded redaction policy: see check.ts. Audit findings include the
+ * `matchPreview` field from scanFile, which is already redacted when
+ * `revealMatches` is false. Setting it explicitly here keeps the policy
+ * auditable from this file alone.
+ */
+const SCAN_OPTS = { revealMatches: false };
+function gitCmd(cwd, args) {
+    try {
+        const stdout = execFileSync("git", args, {
+            cwd,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        return { ok: true, stdout: stdout.trim() };
+    }
+    catch {
+        return { ok: false, stdout: "" };
+    }
+}
+function listTrackedFiles(cwd) {
+    const r = gitCmd(cwd, ["ls-files"]);
+    if (!r.ok)
+        return [];
+    return r.stdout.split("\n").filter(Boolean);
+}
+function checkMarkerScan(cwd, repo, denySet) {
+    if (!repo.isGitRepo) {
+        return {
+            name: "marker-scan",
+            ok: true,
+            findings: [],
+            skipped: true,
+            skipReason: "not a git repo",
+        };
+    }
+    if (denySet.combinedRegex === "") {
+        return {
+            name: "marker-scan",
+            ok: true,
+            findings: [],
+            skipped: true,
+            skipReason: "empty deny set",
+        };
+    }
+    const findings = [];
+    for (const f of listTrackedFiles(cwd)) {
+        const abs = join(cwd, f);
+        if (!existsSync(abs))
+            continue;
+        const r = scanFile(abs, denySet, SCAN_OPTS, cwd);
+        for (const h of r.hits) {
+            findings.push({
+                message: `${f}:${h.line}:${h.column}`,
+                detail: { path: f, line: h.line, column: h.column, matchPreview: h.matchPreview },
+            });
+        }
+    }
+    return { name: "marker-scan", ok: findings.length === 0, findings };
+}
+function checkLockfile(cwd) {
+    const lockPath = join(cwd, "package-lock.json");
+    if (!existsSync(lockPath)) {
+        return {
+            name: "lockfile",
+            ok: true,
+            findings: [],
+            skipped: true,
+            skipReason: "no package-lock.json",
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(lockPath, "utf8"));
+    }
+    catch {
+        return {
+            name: "lockfile",
+            ok: false,
+            findings: [{ message: "package-lock.json is not valid JSON" }],
+        };
+    }
+    const findings = [];
+    const root = parsed;
+    if (root.packages) {
+        for (const [pkgPath, info] of Object.entries(root.packages)) {
+            const resolved = info?.resolved;
+            if (!resolved)
+                continue;
+            try {
+                const u = new URL(resolved);
+                if (u.host !== "registry.npmjs.org" &&
+                    u.host !== "registry.yarnpkg.com" &&
+                    !u.host.endsWith(".github.com") &&
+                    u.host !== "codeload.github.com") {
+                    findings.push({
+                        message: `${pkgPath || "(root)"} resolved from non-public registry: ${u.host}`,
+                        detail: { pkg: pkgPath, host: u.host, resolved },
+                    });
+                }
+            }
+            catch {
+                /* skip non-URL entries */
+            }
+        }
+    }
+    return { name: "lockfile", ok: findings.length === 0, findings };
+}
+const FIXTURE_DIR_NAMES = new Set([
+    "__fixtures__",
+    "fixtures",
+    "fixture",
+    "test-fixtures",
+    "testdata",
+]);
+function findFixtureDirs(cwd) {
+    const out = [];
+    function recurse(dir, depth) {
+        if (depth > 4)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            if (name === ".git" || name === "node_modules")
+                continue;
+            const full = join(dir, name);
+            let st;
+            try {
+                st = statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (!st.isDirectory())
+                continue;
+            if (FIXTURE_DIR_NAMES.has(name)) {
+                out.push(full);
+            }
+            else {
+                recurse(full, depth + 1);
+            }
+        }
+    }
+    recurse(cwd, 0);
+    return out;
+}
+function checkFixtures(cwd, repo, denySet) {
+    if (denySet.combinedRegex === "") {
+        return {
+            name: "fixtures",
+            ok: true,
+            findings: [],
+            skipped: true,
+            skipReason: "empty deny set",
+        };
+    }
+    const dirs = findFixtureDirs(cwd);
+    if (dirs.length === 0) {
+        return {
+            name: "fixtures",
+            ok: true,
+            findings: [],
+            skipped: true,
+            skipReason: "no fixture directories found",
+        };
+    }
+    const findings = [];
+    function recurse(dir) {
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            const full = join(dir, name);
+            let st;
+            try {
+                st = statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (st.isDirectory()) {
+                recurse(full);
+                continue;
+            }
+            if (!st.isFile())
+                continue;
+            const r = scanFile(full, denySet, SCAN_OPTS, repo.isGitRepo ? cwd : undefined);
+            for (const h of r.hits) {
+                const rel = relative(cwd, full);
+                findings.push({
+                    message: `${rel}:${h.line}:${h.column}`,
+                    detail: { path: rel, line: h.line, column: h.column, matchPreview: h.matchPreview },
+                });
+            }
+        }
+    }
+    for (const d of dirs)
+        recurse(d);
+    return { name: "fixtures", ok: findings.length === 0, findings };
+}
+function checkRemote(cwd, repo) {
+    if (!repo.isGitRepo) {
+        return {
+            name: "remote",
+            ok: true,
+            findings: [],
+            skipped: true,
+            skipReason: "not a git repo",
+        };
+    }
+    const r = gitCmd(cwd, ["remote", "get-url", "origin"]);
+    const remote = r.ok ? r.stdout : "";
+    const findings = [];
+    if (repo.class === "scratch") {
+        if (remote !== "") {
+            findings.push({
+                message: `class=scratch but origin remote is set: ${remote}`,
+                detail: { remote },
+            });
+        }
+        return { name: "remote", ok: findings.length === 0, findings };
+    }
+    if (repo.class === "customer-coupled") {
+        if (remote === "") {
+            findings.push({ message: "class=customer-coupled but no origin remote is set" });
+            return { name: "remote", ok: false, findings };
+        }
+        const lower = remote.toLowerCase();
+        const anyEngagementInRemote = repo.engagements.some(e => lower.includes(e.toLowerCase()));
+        if (!anyEngagementInRemote) {
+            findings.push({
+                message: "class=customer-coupled but no engagement id appears in the remote URL",
+                detail: { remote, engagements: repo.engagements },
+            });
+        }
+        return { name: "remote", ok: findings.length === 0, findings };
+    }
+    return { name: "remote", ok: true, findings: [] };
+}
+const auditInput = {
+    cwd: z
+        .string()
+        .optional()
+        .describe("Working directory to audit (defaults to server cwd)."),
+};
+/**
+ * `repo_aegis_audit` — composite repo health check.
+ *
+ * Runs the same default checks as `repo-aegis audit --json` minus the
+ * network-dependent / archive-extracting flags (`--org`, `--published`,
+ * `--history`). Those are intentionally omitted from the MCP surface:
+ *
+ *   - `--org` is a cross-border data transfer and requires explicit
+ *     human consent (`--accept-cross-border` or the matching env var).
+ *     The agent must never opt the user in to that.
+ *   - `--published` extracts archives to a temp dir; that's a CLI
+ *     workflow, not an interactive-agent one.
+ *   - `--history` is slow (full git-log sweep per pattern). If the user
+ *     wants it, they run the CLI directly.
+ *
+ * Hits are returned with `matchPreview` already redacted by core.
+ */
+export function registerAuditTool(server) {
+    server.registerTool("repo_aegis_audit", {
+        description: "Composite repo health check: marker scan over tracked files, " +
+            "package-lock.json non-public-registry check, fixture-directory scan, " +
+            "remote-vs-class consistency. Equivalent to `repo-aegis audit --json` " +
+            "with default flags. Network sweeps (--org), archive scans " +
+            "(--published), and full-history sweeps (--history) are deliberately " +
+            "NOT exposed here — those require explicit human consent or run " +
+            "long; use the CLI for them.",
+        inputSchema: auditInput,
+    }, async ({ cwd }) => {
+        const wd = cwd ?? process.cwd();
+        const repo = readRepoConfig(wd);
+        const denySet = computeDenySet(repo);
+        const results = [
+            checkMarkerScan(wd, repo, denySet),
+            checkLockfile(wd),
+            checkFixtures(wd, repo, denySet),
+            checkRemote(wd, repo),
+        ];
+        const failed = results.filter(c => !c.ok);
+        const totalFindings = results.reduce((sum, c) => sum + c.findings.length, 0);
+        return jsonResult({
+            action: "audit",
+            cwd: wd,
+            class: repo.class,
+            engagements: repo.engagements,
+            checks: results,
+            summary: {
+                run: results.length,
+                failed: failed.length,
+                totalFindings,
+            },
+            warnings: denySet.warnings,
+        });
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/tools/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/tools/audit.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,qDAAqD;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,cAAc,EACd,cAAc,EACd,QAAQ,GAIT,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC;;;;;GAKG;AACH,MAAM,SAAS,GAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAexD,SAAS,MAAM,CAAC,GAAW,EAAE,IAAc;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACvC,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,IAAgB,EAAE,OAAgB;IACtE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,gBAAgB;SAC7B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,gBAAgB;SAC7B,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE;gBACrC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,sBAAsB;SACnC,CAAC;IACJ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,MAA8D,CAAC;IAC5E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;YAChC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC5B,IACE,CAAC,CAAC,IAAI,KAAK,oBAAoB;oBAC/B,CAAC,CAAC,IAAI,KAAK,sBAAsB;oBACjC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;oBAC/B,CAAC,CAAC,IAAI,KAAK,qBAAqB,EAChC,CAAC;oBACD,QAAQ,CAAC,IAAI,CAAC;wBACZ,OAAO,EAAE,GAAG,OAAO,IAAI,QAAQ,uCAAuC,CAAC,CAAC,IAAI,EAAE;wBAC9E,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE;qBACjD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,cAAc;IACd,UAAU;IACV,SAAS;IACT,eAAe;IACf,UAAU;CACX,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,SAAS,OAAO,CAAC,GAAW,EAAE,KAAa;QACzC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO;QACtB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,cAAc;gBAAE,SAAS;YACzD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7B,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;gBAAE,SAAS;YAChC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,IAAgB,EAAE,OAAgB;IACpE,IAAI,OAAO,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,gBAAgB;SAC7B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,8BAA8B;SAC3C,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,SAAS,OAAO,CAAC,GAAW;QAC1B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7B,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,SAAS;YACX,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE;oBACvC,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE;iBACpF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,IAAgB;IAChD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,gBAAgB;SAC7B,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,2CAA2C,MAAM,EAAE;gBAC5D,MAAM,EAAE,EAAE,MAAM,EAAE;aACnB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;QACtC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC;YACjF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,qBAAqB,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,uEAAuE;gBAChF,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,GAAG;IACjB,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,sDAAsD,CAAC;CACpE,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAiB;IACjD,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,WAAW,EACT,+DAA+D;YAC/D,uEAAuE;YACvE,uEAAuE;YACvE,4DAA4D;YAC5D,sEAAsE;YACtE,iEAAiE;YACjE,6BAA6B;QAC/B,WAAW,EAAE,UAAU;KACxB,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QAChB,MAAM,EAAE,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAErC,MAAM,OAAO,GAAkB;YAC7B,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC;YAClC,aAAa,CAAC,EAAE,CAAC;YACjB,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC;YAChC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC;SACtB,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAE7E,OAAO,UAAU,CAAC;YAChB,MAAM,EAAE,OAAO;YACf,GAAG,EAAE,EAAE;YACP,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,OAAO;YACf,OAAO,EAAE;gBACP,GAAG,EAAE,OAAO,CAAC,MAAM;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,aAAa;aACd;YACD,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/check.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerCheckTools(server: McpServer): void;
+//# sourceMappingURL=check.d.ts.map

package/dist/tools/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/tools/check.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAmDzE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAyG1D"}

package/dist/tools/check.js

@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Richard Myers and contributors.
+import { z } from "zod";
+import { computeDenySet, CustomerCoupledNoEngagementError, readRepoConfig, scanFile, scanStagedDiff, } from "@de-otio/repo-aegis-core";
+import { errorResult, jsonResult } from "./_util.js";
+/**
+ * Hard-coded redaction policy: literal markers MUST NOT cross the MCP
+ * boundary. The `--verbose` / `revealMatches` path is for a human at a
+ * terminal only. Setting this explicitly (rather than relying on the
+ * core default) keeps the policy auditable from this file alone.
+ */
+const SCAN_OPTS = { revealMatches: false };
+function repoJson(repo) {
+    return {
+        cwd: repo.cwd,
+        isGitRepo: repo.isGitRepo,
+        class: repo.class,
+        classExplicit: repo.classExplicit,
+        engagements: repo.engagements,
+    };
+}
+const checkPathInput = {
+    path: z
+        .string()
+        .describe("Path to scan. Resolved (symlinks followed) and rejected if it escapes the repo working tree."),
+    cwd: z
+        .string()
+        .optional()
+        .describe("Working directory for repo class/engagement lookup (defaults to server cwd)."),
+};
+const checkStagedInput = {
+    cwd: z
+        .string()
+        .optional()
+        .describe("Working directory inside the git repo whose staged diff to scan."),
+};
+export function registerCheckTools(server) {
+    server.registerTool("repo_aegis_check_path", {
+        description: "Scan a single file against this repo's scoped deny set. " +
+            "Equivalent to `repo-aegis check --path <file> --json`. Returns hits " +
+            "with line/column and engagement attribution; literal matches are " +
+            "redacted (matchPreview), and the agent must NEVER paste them back to " +
+            "the user verbatim — refer to the leak abstractly.",
+        inputSchema: checkPathInput,
+    }, async ({ path, cwd }) => {
+        const repo = readRepoConfig(cwd ?? process.cwd());
+        if (repo.isGitRepo && repo.class === "customer-coupled" && repo.engagements.length === 0) {
+            const err = new CustomerCoupledNoEngagementError();
+            return errorResult({ code: err.code, error: err.message });
+        }
+        const denySet = computeDenySet(repo);
+        if (denySet.combinedRegex === "") {
+            return jsonResult({
+                mode: "path",
+                hits: [],
+                historyHits: [],
+                skipped: [],
+                repo: repoJson(repo),
+                denySet: { files: denySet.files.map(f => f.stem), patternCount: 0 },
+                advisory: repo.class === "scratch",
+                warnings: denySet.warnings,
+                status: "no-deny-set",
+            });
+        }
+        let hits = [];
+        let skipped = [];
+        try {
+            const r = scanFile(path, denySet, SCAN_OPTS, repo.isGitRepo ? repo.cwd : undefined);
+            hits = r.hits;
+            skipped = r.skipped;
+        }
+        catch (err) {
+            return errorResult({ error: err.message });
+        }
+        const result = {
+            mode: "path",
+            hits,
+            historyHits: [],
+            skipped,
+            repo: repoJson(repo),
+            denySet: { files: denySet.files.map(f => f.stem), patternCount: denySet.patterns.length },
+            advisory: repo.class === "scratch",
+            warnings: denySet.warnings,
+        };
+        return jsonResult(result);
+    });
+    server.registerTool("repo_aegis_check_staged", {
+        description: "Scan the staged diff (added lines only) against this repo's scoped " +
+            "deny set. Equivalent to `repo-aegis check --staged --json`. Use this " +
+            "as a pre-commit gate. Returns the same shape as check_path; redaction " +
+            "applies.",
+        inputSchema: checkStagedInput,
+    }, async ({ cwd }) => {
+        const repo = readRepoConfig(cwd ?? process.cwd());
+        if (!repo.isGitRepo) {
+            return errorResult({
+                code: "NOT_GIT_REPO",
+                error: "not a git repo; --staged requires a git repo",
+            });
+        }
+        if (repo.class === "customer-coupled" && repo.engagements.length === 0) {
+            const err = new CustomerCoupledNoEngagementError();
+            return errorResult({ code: err.code, error: err.message });
+        }
+        const denySet = computeDenySet(repo);
+        if (denySet.combinedRegex === "") {
+            return jsonResult({
+                mode: "staged",
+                hits: [],
+                historyHits: [],
+                skipped: [],
+                repo: repoJson(repo),
+                denySet: { files: denySet.files.map(f => f.stem), patternCount: 0 },
+                advisory: repo.class === "scratch",
+                warnings: denySet.warnings,
+                status: "no-deny-set",
+            });
+        }
+        const r = scanStagedDiff(repo, denySet, SCAN_OPTS);
+        const result = {
+            mode: "staged",
+            hits: r.hits,
+            historyHits: [],
+            skipped: r.skipped,
+            repo: repoJson(repo),
+            denySet: { files: denySet.files.map(f => f.stem), patternCount: denySet.patterns.length },
+            advisory: repo.class === "scratch",
+            warnings: denySet.warnings,
+        };
+        return jsonResult(result);
+    });
+}
+//# sourceMappingURL=check.js.map

package/dist/tools/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/tools/check.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,qDAAqD;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,cAAc,EACd,gCAAgC,EAChC,cAAc,EACd,QAAQ,EACR,cAAc,GAMf,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;GAKG;AACH,MAAM,SAAS,GAAgB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAaxD,SAAS,QAAQ,CAAC,IAAuC;IACvD,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,CACP,8FAA8F,CAC/F;IACH,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,8EAA8E,CAAC;CAC5F,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,kEAAkE,CAAC;CAChF,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,MAAiB;IAClD,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,WAAW,EACT,0DAA0D;YAC1D,sEAAsE;YACtE,mEAAmE;YACnE,uEAAuE;YACvE,mDAAmD;QACrD,WAAW,EAAE,cAAc;KAC5B,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,kBAAkB,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzF,MAAM,GAAG,GAAG,IAAI,gCAAgC,EAAE,CAAC;YACnD,OAAO,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC;gBAChB,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,EAAE;gBACR,WAAW,EAAE,EAAE;gBACf,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACpB,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;gBACnE,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS;gBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,GAAc,EAAE,CAAC;QACzB,IAAI,OAAO,GAAkB,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACpF,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;YACd,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,WAAW,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,MAAM,GAAqB;YAC/B,IAAI,EAAE,MAAM;YACZ,IAAI;YACJ,WAAW,EAAE,EAAE;YACf,OAAO;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YACpB,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE;YACzF,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;QACF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,WAAW,EACT,qEAAqE;YACrE,uEAAuE;YACvE,wEAAwE;YACxE,UAAU;QACZ,WAAW,EAAE,gBAAgB;KAC9B,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,WAAW,CAAC;gBACjB,IAAI,EAAE,cAAc;gBACpB,KAAK,EAAE,8CAA8C;aACtD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,kBAAkB,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvE,MAAM,GAAG,GAAG,IAAI,gCAAgC,EAAE,CAAC;YACnD,OAAO,WAAW,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC;gBAChB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,EAAE;gBACR,WAAW,EAAE,EAAE;gBACf,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACpB,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;gBACnE,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS;gBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,MAAM,GAAqB;YAC/B,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YACpB,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE;YACzF,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;QACF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/engagements.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerEngagementsTools(server: McpServer): void;
+//# sourceMappingURL=engagements.d.ts.map

package/dist/tools/engagements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engagements.d.ts","sourceRoot":"","sources":["../../src/tools/engagements.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgBzE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAkFhE"}

package/dist/tools/engagements.js

@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Richard Myers and contributors.
+import { z } from "zod";
+import { isActive, loadRegistry, RegistryNotFoundError, } from "@de-otio/repo-aegis-core";
+import { errorResult, jsonResult } from "./_util.js";
+const listInput = {
+    includeEnded: z
+        .boolean()
+        .optional()
+        .describe("If true, include engagements past the 12-month retention window (equivalent to `--all`). Default: false."),
+};
+const showInput = {
+    id: z.string().min(1).describe("Engagement id (exact, not fuzzy)."),
+};
+export function registerEngagementsTools(server) {
+    server.registerTool("repo_aegis_engagements_list", {
+        description: "List engagements in the registry. Equivalent to " +
+            "`repo-aegis engagements list --json`. Returns id, name, started, " +
+            "ended, active, markerCount per engagement (markers themselves are " +
+            "NOT exposed). Use `includeEnded` to see retained ended engagements.",
+        inputSchema: listInput,
+    }, async ({ includeEnded }) => {
+        let reg;
+        try {
+            reg = loadRegistry();
+        }
+        catch (err) {
+            if (err instanceof RegistryNotFoundError) {
+                return errorResult({
+                    code: "REGISTRY_NOT_FOUND",
+                    error: "engagement registry not found; run `repo-aegis init` first",
+                    details: err.path,
+                });
+            }
+            return errorResult({ error: err.message });
+        }
+        const filtered = includeEnded ? reg.engagements : reg.engagements.filter(isActive);
+        return jsonResult({
+            engagements: filtered.map(e => ({
+                id: e.id,
+                name: e.name,
+                started: e.started ?? null,
+                ended: e.ended ?? null,
+                active: isActive(e),
+                markerCount: e.markers.length,
+            })),
+            alwaysBlock: { patternCount: reg.alwaysBlock.length },
+        });
+    });
+    server.registerTool("repo_aegis_engagements_show", {
+        description: "Show one engagement's metadata (no markers). Equivalent to " +
+            "`repo-aegis engagements show <id> --json`. Returns id, name, started, " +
+            "ended, active, markerCount, notes.",
+        inputSchema: showInput,
+    }, async ({ id }) => {
+        let reg;
+        try {
+            reg = loadRegistry();
+        }
+        catch (err) {
+            if (err instanceof RegistryNotFoundError) {
+                return errorResult({
+                    code: "REGISTRY_NOT_FOUND",
+                    error: "engagement registry not found; run `repo-aegis init` first",
+                    details: err.path,
+                });
+            }
+            return errorResult({ error: err.message });
+        }
+        const e = reg.engagements.find(x => x.id === id);
+        if (!e) {
+            return errorResult({
+                code: "ENGAGEMENT_NOT_FOUND",
+                error: `engagement "${id}" not found`,
+            });
+        }
+        return jsonResult({
+            action: "engagements-show",
+            id: e.id,
+            name: e.name,
+            started: e.started ?? null,
+            ended: e.ended ?? null,
+            active: isActive(e),
+            markerCount: e.markers.length,
+            notes: e.notes ?? null,
+        });
+    });
+}
+//# sourceMappingURL=engagements.js.map

package/dist/tools/engagements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engagements.js","sourceRoot":"","sources":["../../src/tools/engagements.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,qDAAqD;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,SAAS,GAAG;IAChB,YAAY,EAAE,CAAC;SACZ,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,0GAA0G,CAC3G;CACJ,CAAC;AAEF,MAAM,SAAS,GAAG;IAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;CACpE,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,MAAiB;IACxD,MAAM,CAAC,YAAY,CACjB,6BAA6B,EAC7B;QACE,WAAW,EACT,kDAAkD;YAClD,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;QACvE,WAAW,EAAE,SAAS;KACvB,EACD,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;QACzB,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,OAAO,WAAW,CAAC;oBACjB,IAAI,EAAE,oBAAoB;oBAC1B,KAAK,EAAE,4DAA4D;oBACnE,OAAO,EAAE,GAAG,CAAC,IAAI;iBAClB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,WAAW,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnF,OAAO,UAAU,CAAC;YAChB,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;gBAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;gBACtB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACnB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,WAAW,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE;SACtD,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,6BAA6B,EAC7B;QACE,WAAW,EACT,6DAA6D;YAC7D,wEAAwE;YACxE,oCAAoC;QACtC,WAAW,EAAE,SAAS;KACvB,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACf,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,OAAO,WAAW,CAAC;oBACjB,IAAI,EAAE,oBAAoB;oBAC1B,KAAK,EAAE,4DAA4D;oBACnE,OAAO,EAAE,GAAG,CAAC,IAAI;iBAClB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,WAAW,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,WAAW,CAAC;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,KAAK,EAAE,eAAe,EAAE,aAAa;aACtC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC;YAChB,MAAM,EAAE,kBAAkB;YAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;YAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;YACtB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACnB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;SACvB,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/first-touch.d.ts

@@ -0,0 +1,26 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export { firstTouchClassify, redactOrg, } from "@de-otio/repo-aegis-core";
+export type { FirstTouchResult, FirstTouchOptions, FirstTouchSkipReason, } from "@de-otio/repo-aegis-core";
+/**
+ * `aegis_classify_first_touch` — agent-facing entry point for Phase 1
+ * of the zero-config onboarding flow. Called once per session at
+ * SessionStart. Returns one of four statuses; the agent reacts:
+ *
+ *   - `already-classified`: nothing to do; proceed.
+ *   - `applied`: per-repo config was just set; proceed. If
+ *     `markerWarning` is non-null, prompt the user to populate
+ *     markers via `suggest-markers`.
+ *   - `needs-confirmation`: surface `redactedOrg` to the user with a
+ *     confirmation prompt. On user-confirm, call
+ *     `repo_aegis_engagements_add` (with the full `org` from the
+ *     response) to register the engagement, then call this tool
+ *     again to apply the classification.
+ *   - `skipped`: nothing applicable; proceed.
+ *
+ * Important: this tool **does not mutate the registry**. The
+ * `applied` path mutates per-repo `git config` only. Registry edits
+ * always require explicit user confirmation via a follow-up
+ * `repo_aegis_engagements_add` call.
+ */
+export declare function registerFirstTouchTool(server: McpServer): void;
+//# sourceMappingURL=first-touch.d.ts.map

package/dist/tools/first-touch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"first-touch.d.ts","sourceRoot":"","sources":["../../src/tools/first-touch.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIzE,OAAO,EACL,kBAAkB,EAClB,SAAS,GACV,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAWlC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAkB9D"}

package/dist/tools/first-touch.js

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+// Copyright (C) 2026 Richard Myers and contributors.
+import { z } from "zod";
+import { firstTouchClassify } from "@de-otio/repo-aegis-core";
+import { jsonResult } from "./_util.js";
+// Re-export for tests that import from this module path.
+export { firstTouchClassify, redactOrg, } from "@de-otio/repo-aegis-core";
+const inputSchema = {
+    cwd: z
+        .string()
+        .optional()
+        .describe("Working directory to inspect (defaults to the server process's cwd). Should be the agent's session cwd."),
+};
+/**
+ * `aegis_classify_first_touch` — agent-facing entry point for Phase 1
+ * of the zero-config onboarding flow. Called once per session at
+ * SessionStart. Returns one of four statuses; the agent reacts:
+ *
+ *   - `already-classified`: nothing to do; proceed.
+ *   - `applied`: per-repo config was just set; proceed. If
+ *     `markerWarning` is non-null, prompt the user to populate
+ *     markers via `suggest-markers`.
+ *   - `needs-confirmation`: surface `redactedOrg` to the user with a
+ *     confirmation prompt. On user-confirm, call
+ *     `repo_aegis_engagements_add` (with the full `org` from the
+ *     response) to register the engagement, then call this tool
+ *     again to apply the classification.
+ *   - `skipped`: nothing applicable; proceed.
+ *
+ * Important: this tool **does not mutate the registry**. The
+ * `applied` path mutates per-repo `git config` only. Registry edits
+ * always require explicit user confirmation via a follow-up
+ * `repo_aegis_engagements_add` call.
+ */
+export function registerFirstTouchTool(server) {
+    server.registerTool("aegis_classify_first_touch", {
+        description: "Classify the current repo on first touch (Phase 1 onboarding). " +
+            "Returns one of: already-classified, applied, needs-confirmation, " +
+            "skipped. Never mutates the registry — only per-repo git config. " +
+            "On `needs-confirmation`, the agent must use `redactedOrg` in any " +
+            "context-bearing summary; the full `org` is for the user's " +
+            "confirmation prompt only.",
+        inputSchema,
+    }, async ({ cwd }) => {
+        const result = firstTouchClassify({ ...(cwd !== undefined && { cwd }) });
+        return jsonResult(result);
+    });
+}
+//# sourceMappingURL=first-touch.js.map