@dypai-ai/mcp 1.5.26 → 1.5.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dypai-ai/mcp",
-  "version": "1.5.26",
+  "version": "1.5.28",
   "description": "DYPAI MCP Server — AI agent toolkit for building and deploying full-stack apps",
   "type": "module",
   "main": "src/index.js",

package/src/auto-update.js

@@ -1,13 +1,11 @@
 /**
  * Self-update for @dypai-ai/mcp.
  *
- * On startup, checks the npm registry for a newer version. If found, performs
+ * On every startup, checks the npm registry for a newer version. If found, performs
  * the appropriate update (clear npx cache or `npm install -g`) and exits with
  * code 0 so the host (Cursor / Claude / Trae / VSCode) re-spawns the process
  * with the freshly installed version.
  *
- * Throttled to one check every 6h to avoid hammering the registry.
- *
  * Disable with:  DYPAI_NO_AUTOUPDATE=1
  */
 
@@ -21,13 +19,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const PKG_PATH = join(__dirname, "..", "package.json");
 const PKG_NAME = "@dypai-ai/mcp";
 const REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
-// Dist-tags endpoint is tiny (<200B) — used to check if there's a CRITICAL
-// release the user must upgrade to immediately, bypassing the 6h throttle.
-// To mark a version as critical after publish:
-//   npm dist-tag add @dypai-ai/mcp@1.4.5 critical
-const DIST_TAGS_URL = `https://registry.npmjs.org/-/package/${PKG_NAME}/dist-tags`;
 const CHECK_TIMEOUT_MS = 2000;
-const THROTTLE_HOURS = 6;
 const STATE_FILE = join(tmpdir(), "dypai-mcp-update-state.json");
 
 function log(msg) {
@@ -73,32 +65,6 @@ async function fetchLatestManifest() {
   }
 }
 
-/**
- * Fetch the `critical` dist-tag (if published). Used to bypass the 6h throttle
- * when a release is important enough that users must upgrade on next spawn.
- *
- * Returns the critical version string (e.g. "1.4.5") or null if no critical
- * tag is set, the registry is unreachable, or the response is malformed.
- *
- * Cost: one tiny JSON fetch (~200 bytes) per spawn. Adds ~50-150ms to startup
- * but runs in parallel with the rest of the MCP init, so wall-clock impact is
- * usually zero.
- */
-async function fetchCriticalVersion() {
-  const ctrl = new AbortController();
-  const timer = setTimeout(() => ctrl.abort(), CHECK_TIMEOUT_MS);
-  try {
-    const res = await fetch(DIST_TAGS_URL, { signal: ctrl.signal });
-    if (!res.ok) return null;
-    const tags = await res.json();
-    return typeof tags?.critical === "string" ? tags.critical : null;
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
 /**
  * After npm publish there's a 30s–2min window where the registry knows the
  * version but the tarball is not yet replicated across the CDN. If we clear
@@ -170,37 +136,21 @@ function installGlobalLatest() {
  * Main entry point — call once at startup.
  * Returns quickly. Exits the process if an update was applied.
  */
-export async function checkForUpdates({ force = false } = {}) {
+export async function checkForUpdates() {
   if (process.env.DYPAI_NO_AUTOUPDATE === "1") return { skipped: "disabled" };
 
   const current = getCurrentVersion();
   if (!current) return { skipped: "no current version" };
 
-  // ── Critical release check (bypasses the 6h throttle) ────────────────────
-  // If an ops person has run `npm dist-tag add @dypai-ai/mcp@X.Y.Z critical`,
-  // every spawn picks that up and forces an upgrade regardless of when the
-  // last normal check ran. Used for security / data-loss bug fixes where
-  // 6-24h propagation is too slow.
-  const criticalVersion = await fetchCriticalVersion();
-  const hasCritical = criticalVersion && compareVersions(criticalVersion, current) > 0;
-  if (hasCritical) {
-    log(`CRITICAL update required: ${current} → ${criticalVersion} (bypassing throttle)`);
-    force = true;
-  }
-
-  // Throttle (skipped when force or critical)
-  if (!force) {
-    const state = readState();
-    if (state.lastCheckAt) {
-      const hoursAgo = (Date.now() - state.lastCheckAt) / 3_600_000;
-      if (hoursAgo < THROTTLE_HOURS) return { skipped: "throttled" };
-    }
-  }
-
   const manifest = await fetchLatestManifest();
   const latest = manifest?.version || null;
   const tarballUrl = manifest?.dist?.tarball || null;
-  writeState({ lastCheckAt: Date.now(), lastSeenLatest: latest, current });
+  writeState({
+    ...readState(),
+    lastCheckAt: Date.now(),
+    lastSeenLatest: latest,
+    current,
+  });
 
   if (!latest) return { skipped: "registry unreachable" };
   if (compareVersions(latest, current) <= 0) return { uptodate: true, current };
@@ -213,7 +163,7 @@ export async function checkForUpdates({ force = false } = {}) {
   // If we clear the cache + exit during that window, next spawn fails.
   const ready = await isTarballReady(tarballUrl);
   if (!ready) {
-    log(`new version ${latest} not yet downloadable from CDN; will retry later`);
+    log(`new version ${latest} not yet downloadable from CDN; will retry on next spawn`);
     return { skipped: "tarball not ready" };
   }
 
@@ -223,6 +173,11 @@ export async function checkForUpdates({ force = false } = {}) {
   if (method === "npx") {
     log(`tarball verified — clearing npx cache so the next spawn pulls ${PKG_NAME}@${latest}`);
     updated = clearNpxCacheForPackage();
+    // Even if no cached dir matched, exit so npx re-resolves @latest on respawn.
+    if (!updated) {
+      log("no npx cache entry found; exiting anyway so the host re-resolves @latest");
+      updated = true;
+    }
   } else if (method === "global") {
     log(`tarball verified — running: npm install -g ${PKG_NAME}@latest`);
     updated = installGlobalLatest();

package/src/index.js

@@ -71,9 +71,9 @@ import { filterSearchDocsForStudio } from "./searchDocsFilter.js"
 // disk for when dypai_trace is re-enabled, but not imported here.
 
 // ── Self-update ─────────────────────────────────────────────────────────────
-// Throttled (6h) check against the npm registry. If a newer version is
-// available, the update is performed and the process exits cleanly so the
-// IDE re-spawns it with the latest. Disable with DYPAI_NO_AUTOUPDATE=1.
+// Checks the npm registry on every spawn. If a newer version is available,
+// the update is performed and the process exits cleanly so the IDE re-spawns
+// with the latest. Disable with DYPAI_NO_AUTOUPDATE=1.
 // Network failures are silently ignored — never blocks startup more than ~2s.
 await checkForUpdates().catch(() => {})
 

package/src/lib/backendSnapshot.js

@@ -0,0 +1,214 @@
+/**
+ * Strict allowlist for backend snapshots sent to the cloud compiler.
+ * Mirrors dypai-backend-compiler/src/snapshot.ts
+ */
+
+import { readFile, readdir, stat } from "node:fs/promises"
+import { join, relative } from "node:path"
+
+export const DEFAULT_MAX_SNAPSHOT_BYTES = 5 * 1024 * 1024
+export const DEFAULT_MAX_FILE_BYTES = 512 * 1024
+export const SCHEMA_SQL_MAX_BYTES = 2 * 1024 * 1024
+
+const DENY_PREFIXES = [
+  "node_modules/",
+  "src/",
+  "public/",
+  ".git/",
+  ".env",
+  "dypai/types/",
+]
+
+const DENY_SUFFIXES = [
+  ".env",
+  ".pem",
+  ".key",
+  ".p12",
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".zip",
+  ".tar",
+  ".gz",
+  ".wasm",
+  ".pdf",
+]
+
+function isFlowPath(path) {
+  return path.startsWith("dypai/flows/") && /\.flow\.ts$/i.test(path)
+}
+
+function isEndpointYaml(path) {
+  return path.startsWith("dypai/endpoints/") && /\.(ya?ml)$/i.test(path)
+}
+
+function isAllowedCatalog(path) {
+  return [
+    "dypai/capability-catalog.json",
+    "dypai/capability-brief.md",
+    "dypai/node-catalog.json",
+  ].includes(path)
+}
+
+export function normalizeSnapshotPath(rawPath) {
+  const trimmed = String(rawPath || "").trim().replace(/\\/g, "/").replace(/^\.\//, "")
+  if (!trimmed || trimmed.startsWith("/")) return null
+  if (trimmed.includes("\0")) return null
+
+  const segments = trimmed.split("/")
+  if (segments.some((segment) => !segment || segment === "." || segment === "..")) return null
+
+  const normalized = segments.join("/")
+  const lower = normalized.toLowerCase()
+
+  for (const prefix of DENY_PREFIXES) {
+    if (lower.startsWith(prefix) || lower === prefix.replace(/\/$/, "")) return null
+  }
+  for (const suffix of DENY_SUFFIXES) {
+    if (lower.endsWith(suffix)) return null
+  }
+
+  if (isFlowPath(normalized)) return normalized
+  if (isEndpointYaml(normalized)) return normalized
+  if (normalized === "dypai/realtime.yaml") return normalized
+  if (normalized === "dypai/schema.sql") return normalized
+  if (isAllowedCatalog(normalized)) return normalized
+  if (normalized === "dypai.config.yaml") return normalized
+
+  return null
+}
+
+export function filterSnapshotFiles(files, options = {}) {
+  const maxSnapshotBytes = options.maxSnapshotBytes ?? DEFAULT_MAX_SNAPSHOT_BYTES
+  const maxFileBytes = options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES
+  const schemaSqlMaxBytes = options.schemaSqlMaxBytes ?? SCHEMA_SQL_MAX_BYTES
+
+  const accepted = new Map()
+  const rejected = []
+  let totalBytes = 0
+
+  for (const file of files) {
+    const rawPath = typeof file?.path === "string" ? file.path : ""
+    const content = typeof file?.content === "string" ? file.content : null
+    const normalized = normalizeSnapshotPath(rawPath)
+
+    if (!normalized) {
+      rejected.push({ path: rawPath || "(missing path)", reason: "path_not_allowlisted" })
+      continue
+    }
+    if (content === null) {
+      rejected.push({ path: normalized, reason: "content_must_be_string" })
+      continue
+    }
+
+    const bytes = Buffer.byteLength(content, "utf8")
+    const limit = normalized === "dypai/schema.sql" ? schemaSqlMaxBytes : maxFileBytes
+    if (bytes > limit) {
+      rejected.push({ path: normalized, reason: `file_too_large:${bytes}>${limit}` })
+      continue
+    }
+    if (totalBytes + bytes > maxSnapshotBytes) {
+      rejected.push({ path: normalized, reason: "snapshot_size_limit_exceeded" })
+      continue
+    }
+
+    accepted.set(normalized, { path: normalized, content })
+    totalBytes += bytes
+  }
+
+  if (accepted.size === 0) {
+    return {
+      ok: false,
+      files: [],
+      rejected,
+      totalBytes,
+      error: "snapshot has no allowlisted backend files",
+    }
+  }
+
+  return {
+    ok: true,
+    files: [...accepted.values()].sort((a, b) => a.path.localeCompare(b.path)),
+    rejected,
+    totalBytes,
+  }
+}
+
+async function walkAllowlistedFiles(rootDir, projectRoot) {
+  const out = []
+  const candidates = [
+    join(rootDir, "flows"),
+    join(rootDir, "endpoints"),
+    join(rootDir, "realtime.yaml"),
+    join(rootDir, "schema.sql"),
+    join(rootDir, "capability-catalog.json"),
+    join(rootDir, "capability-brief.md"),
+    join(rootDir, "node-catalog.json"),
+    join(projectRoot, "dypai.config.yaml"),
+  ]
+
+  async function walkDir(dir, relBase) {
+    let entries = []
+    try {
+      entries = await readdir(dir, { withFileTypes: true })
+    } catch {
+      return
+    }
+    for (const entry of entries) {
+      const rel = `${relBase}/${entry.name}`.replace(/^\//, "")
+      const full = join(dir, entry.name)
+      if (entry.isDirectory()) {
+        await walkDir(full, rel)
+      } else if (entry.isFile()) {
+        const normalized = normalizeSnapshotPath(rel)
+        if (normalized) out.push({ full, path: normalized })
+      }
+    }
+  }
+
+  await walkDir(join(rootDir, "flows"), "dypai/flows")
+  await walkDir(join(rootDir, "endpoints"), "dypai/endpoints")
+
+  for (const candidate of candidates.slice(2)) {
+    try {
+      const s = await stat(candidate)
+      if (!s.isFile()) continue
+      const rel = candidate === join(projectRoot, "dypai.config.yaml")
+        ? "dypai.config.yaml"
+        : `dypai/${relative(rootDir, candidate).replace(/\\/g, "/")}`
+      const normalized = normalizeSnapshotPath(rel)
+      if (normalized) out.push({ full: candidate, path: normalized })
+    } catch {
+      // optional file
+    }
+  }
+
+  const deduped = new Map()
+  for (const item of out) deduped.set(item.path, item)
+  return [...deduped.values()].sort((a, b) => a.path.localeCompare(b.path))
+}
+
+export async function collectBackendSnapshotFromDypaiDir(dypaiRootDir, projectRoot = null) {
+  const resolvedRoot = dypaiRootDir
+  const resolvedProjectRoot = projectRoot || (resolvedRoot.endsWith("/dypai") || resolvedRoot.endsWith("\\dypai")
+    ? join(resolvedRoot, "..")
+    : resolvedRoot)
+
+  const fileRefs = await walkAllowlistedFiles(resolvedRoot, resolvedProjectRoot)
+  const files = []
+  for (const ref of fileRefs) {
+    files.push({
+      path: ref.path,
+      content: await readFile(ref.full, "utf8"),
+    })
+  }
+  return filterSnapshotFiles(files)
+}
+
+export const __testing = {
+  isFlowPath,
+  isEndpointYaml,
+  walkAllowlistedFiles,
+}

package/src/lib/cloudBackendCompiler.js

@@ -0,0 +1,54 @@
+/**
+ * Cloud backend compiler client — calls Core API snapshot compile routes.
+ */
+
+import { api } from "../api.js"
+import { collectBackendSnapshotFromDypaiDir } from "./backendSnapshot.js"
+
+function compilerBasePath(projectId) {
+  return `/api/engine/${encodeURIComponent(projectId)}/backend/snapshot`
+}
+
+async function postSnapshotRoute(projectId, route, body) {
+  return api.post(`${compilerBasePath(projectId)}/${route}`, body)
+}
+
+export async function buildSnapshotPayload(dypaiRootDir, projectRoot = null) {
+  return collectBackendSnapshotFromDypaiDir(dypaiRootDir, projectRoot)
+}
+
+export async function cloudValidateSnapshot(projectId, files) {
+  return postSnapshotRoute(projectId, "validate", { files })
+}
+
+export async function cloudListEffectiveEntries(projectId, files) {
+  return postSnapshotRoute(projectId, "list", { files })
+}
+
+export async function cloudResolveEffectiveEndpoint(projectId, files, endpoint) {
+  return postSnapshotRoute(projectId, "resolve", { files, endpoint })
+}
+
+export async function cloudBuildPushPayload(projectId, files, endpoint) {
+  return postSnapshotRoute(projectId, "push-payload", { files, endpoint })
+}
+
+export async function cloudBuildEffectivePushPayloads(projectId, files) {
+  return postSnapshotRoute(projectId, "effective-push-payloads", { files })
+}
+
+export async function cloudGenerateTypes(projectId, files) {
+  return postSnapshotRoute(projectId, "generate-types", { files })
+}
+
+export async function compileFromDypaiDir(projectId, dypaiRootDir, projectRoot = null) {
+  const snapshot = await buildSnapshotPayload(dypaiRootDir, projectRoot)
+  if (!snapshot.ok) {
+    return { ok: false, snapshot, error: snapshot.error || "empty snapshot" }
+  }
+  return { ok: true, snapshot }
+}
+
+export function shouldUseLocalFlowCompiler() {
+  return Boolean(process.env.DYPAI_MONOREPO_ROOT || process.env.DYPAI_USE_LOCAL_FLOW_COMPILER === "1")
+}

package/src/lib/effective-workflows-runner.js

@@ -1,12 +1,21 @@
 /**
- * Bridge to dypai-workspace/scripts/effective-workflows-cli.ts via bun.
- * Used by validate, test-endpoint, planner/push for .flow.ts effective workflows.
+ * Effective workflow runner — cloud compiler by default, local monorepo CLI for dev override.
  */
 
 import { spawnSync } from "node:child_process"
 import { existsSync } from "node:fs"
 import { dirname, join, resolve as resolvePath, basename } from "node:path"
 import { fileURLToPath } from "node:url"
+import {
+  buildSnapshotPayload,
+  cloudBuildEffectivePushPayloads,
+  cloudBuildPushPayload,
+  cloudGenerateTypes,
+  cloudListEffectiveEntries,
+  cloudResolveEffectiveEndpoint,
+  cloudValidateSnapshot,
+  shouldUseLocalFlowCompiler,
+} from "./cloudBackendCompiler.js"
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 
@@ -52,7 +61,7 @@ export function runEffectiveWorkflowsCli(projectRoot, commandArgs = []) {
         severity: "warn",
         rule: "effective_workflow_runner_unavailable",
         message: "Effective workflow runner unavailable (monorepo root not found). YAML workflows still work.",
-        fix_hint: "Set DYPAI_MONOREPO_ROOT or run MCP local from the DYPAI monorepo checkout with bun installed.",
+        fix_hint: "Flow validation now runs in DYPAI cloud by default. Ensure DYPAI_TOKEN is set.",
       },
     }
   }
@@ -113,3 +122,89 @@ export function runEffectiveWorkflowsCli(projectRoot, commandArgs = []) {
 
   return { ok: true, data: parsed }
 }
+
+function endpointArg(commandArgs) {
+  const idx = commandArgs.indexOf("--endpoint")
+  if (idx < 0) return null
+  return commandArgs[idx + 1] || null
+}
+
+function commandFromArgs(commandArgs) {
+  return commandArgs[0] || "validate"
+}
+
+async function runEffectiveWorkflowsCloud(dypaiRootDir, projectRoot, projectId, commandArgs = []) {
+  if (!projectId) {
+    return {
+      ok: false,
+      unavailable: true,
+      warning: {
+        severity: "warn",
+        rule: "effective_workflow_runner_unavailable",
+        message: "Flow compilation requires project_id (set DYPAI_PROJECT_ID or pass project_id).",
+        fix_hint: "Pass project_id to dypai_validate / dypai_push, or set DYPAI_PROJECT_ID in MCP config.",
+      },
+    }
+  }
+
+  const snapshot = await buildSnapshotPayload(dypaiRootDir, projectRoot)
+  if (!snapshot.ok) {
+    const hasFlowFiles = snapshot.rejected?.some((item) => String(item.path || "").includes(".flow.ts"))
+    if (!hasFlowFiles) {
+      return { ok: true, data: { diagnostics: [], entries: [] } }
+    }
+    return {
+      ok: false,
+      unavailable: false,
+      error: snapshot.error || "Failed to build backend snapshot",
+    }
+  }
+
+  const command = commandFromArgs(commandArgs)
+  const endpoint = endpointArg(commandArgs)
+
+  try {
+    if (command === "validate") {
+      const data = await cloudValidateSnapshot(projectId, snapshot.files)
+      return { ok: true, data }
+    }
+    if (command === "list") {
+      const data = await cloudListEffectiveEntries(projectId, snapshot.files)
+      return { ok: true, data }
+    }
+    if (command === "resolve") {
+      const data = await cloudResolveEffectiveEndpoint(projectId, snapshot.files, endpoint)
+      return { ok: true, data }
+    }
+    if (command === "push-payload") {
+      const data = await cloudBuildPushPayload(projectId, snapshot.files, endpoint)
+      return { ok: true, data }
+    }
+    if (command === "push-payloads") {
+      const data = await cloudBuildEffectivePushPayloads(projectId, snapshot.files)
+      return { ok: true, data }
+    }
+    if (command === "generate-types") {
+      const data = await cloudGenerateTypes(projectId, snapshot.files)
+      return { ok: true, data }
+    }
+    return { ok: false, error: `Unsupported cloud compiler command: ${command}` }
+  } catch (error) {
+    return {
+      ok: false,
+      unavailable: false,
+      error: error?.detail?.detail || error?.message || String(error),
+      statusCode: error?.statusCode,
+    }
+  }
+}
+
+export async function runEffectiveWorkflows(dypaiRootDir, projectId, commandArgs = []) {
+  const projectRoot = resolveProjectRootFromDypaiDir(dypaiRootDir)
+  if (shouldUseLocalFlowCompiler()) {
+    return runEffectiveWorkflowsCli(projectRoot, commandArgs)
+  }
+  return runEffectiveWorkflowsCloud(dypaiRootDir, projectRoot, projectId, commandArgs)
+}
+
+export { shouldUseLocalFlowCompiler }

package/src/tools/sync/diff.js

@@ -48,7 +48,7 @@ export const dypaiDiffTool = {
     const targetProjectId = project_id || config?.project_id || null
 
     const [local, remote, stateSnapshot, draftsResult] = await Promise.all([
-      readLocalEffectiveState(rootDir),
+      readLocalEffectiveState(rootDir, targetProjectId),
       fetchRemoteState(targetProjectId),
       readLocalStateSnapshot(rootDir),
       // Pending drafts. Cheap on dev (always 0); on prod surfaces what's

package/src/tools/sync/generate-types.js

@@ -2,15 +2,13 @@
  * Regenerate dypai/types/endpoints.gen.ts from effective Flow/YAML contracts.
  */
 
-import { resolve as resolvePath } from "path"
-import {
-  resolveProjectRootFromDypaiDir,
-  runEffectiveWorkflowsCli,
-} from "../../lib/effective-workflows-runner.js"
+import { mkdir, writeFile } from "fs/promises"
+import { dirname, join, resolve as resolvePath } from "path"
+import { runEffectiveWorkflows } from "../../lib/effective-workflows-runner.js"
 
-export async function runGenerateEndpointTypes(rootDir) {
-  const projectRoot = resolveProjectRootFromDypaiDir(resolvePath(rootDir))
-  const result = runEffectiveWorkflowsCli(projectRoot, ["generate-types"])
+export async function runGenerateEndpointTypes(rootDir, projectId = null) {
+  const resolvedRoot = resolvePath(rootDir)
+  const result = await runEffectiveWorkflows(resolvedRoot, projectId, ["generate-types"])
 
   if (result.unavailable) {
     return {
@@ -37,6 +35,22 @@ export async function runGenerateEndpointTypes(rootDir) {
     }
   }
 
+  if (payload.typesContent && payload.contractJsonContent) {
+    const outDir = join(resolvedRoot, "types")
+    await mkdir(outDir, { recursive: true })
+    const typesPath = join(outDir, "endpoints.gen.ts")
+    const contractPath = join(outDir, "endpoints.contract.json")
+    await writeFile(typesPath, payload.typesContent, "utf8")
+    await writeFile(contractPath, payload.contractJsonContent, "utf8")
+    return {
+      ok: true,
+      endpointCount: payload.endpointCount ?? 0,
+      typesPath,
+      contractPath,
+      endpoints: payload.endpoints || [],
+    }
+  }
+
   return {
     ok: true,
     endpointCount: payload.endpointCount ?? 0,
@@ -56,6 +70,10 @@ export const dypaiGenerateTypesTool = {
   inputSchema: {
     type: "object",
     properties: {
+      project_id: {
+        type: "string",
+        description: "Project UUID. Auto-resolved from DYPAI_PROJECT_ID or dypai.config.yaml if omitted.",
+      },
       root_dir: {
         type: "string",
         description: "Root of the dypai/ folder (default: ./dypai).",
@@ -64,8 +82,13 @@ export const dypaiGenerateTypesTool = {
     },
   },
 
-  async execute({ root_dir = "./dypai" } = {}) {
-    const outcome = await runGenerateEndpointTypes(root_dir)
+  async execute({ project_id, root_dir = "./dypai" } = {}) {
+    const { readLocalConfig } = await import("./planner.js")
+    const { getEnvBoundProjectId } = await import("../project-context.js")
+    const rootDir = resolvePath(process.cwd(), root_dir)
+    const config = await readLocalConfig(rootDir)
+    const projectId = project_id || getEnvBoundProjectId() || config?.project_id || null
+    const outcome = await runGenerateEndpointTypes(rootDir, projectId)
     if (outcome.skipped) {
       return {
         success: false,

package/src/tools/sync/planner.js

@@ -14,8 +14,7 @@ import YAML from "yaml"
 import { proxyToolCall } from "../proxy.js"
 import { deserializeEndpoint, serializeEndpoint } from "./codec.js"
 import {
-  resolveProjectRootFromDypaiDir,
-  runEffectiveWorkflowsCli,
+  runEffectiveWorkflows,
 } from "../../lib/effective-workflows-runner.js"
 
 const ENDPOINT_NAME_RE = /^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/
@@ -434,10 +433,9 @@ export async function readLocalState(rootDir) {
  * Merge YAML endpoints with effective .flow.ts entries. Flow wins over YAML
  * with the same name (shadowed YAML is excluded from push/diff plans).
  */
-export async function readLocalEffectiveState(rootDir) {
+export async function readLocalEffectiveState(rootDir, projectId = null) {
   const yamlState = await readLocalState(rootDir)
-  const projectRoot = resolveProjectRootFromDypaiDir(rootDir)
-  const listResult = runEffectiveWorkflowsCli(projectRoot, ["list"])
+  const listResult = await runEffectiveWorkflows(rootDir, projectId, ["list"])
 
   if (!listResult.ok) {
     return {
@@ -454,7 +452,7 @@ export async function readLocalEffectiveState(rootDir) {
 
   for (const entry of entries) {
     if (entry.source === "flow") {
-      const payloadResult = runEffectiveWorkflowsCli(projectRoot, [
+      const payloadResult = await runEffectiveWorkflows(rootDir, projectId, [
         "push-payload",
         "--endpoint",
         entry.name,

package/src/tools/sync/push.js

@@ -369,7 +369,7 @@ export const dypaiPushTool = {
 
     let typesGenerated = null
     try {
-      typesGenerated = await runGenerateEndpointTypes(rootDir)
+      typesGenerated = await runGenerateEndpointTypes(rootDir, targetProjectId)
     } catch (e) {
       typesGenerated = { ok: false, error: e.message }
     }
@@ -379,7 +379,7 @@ export const dypaiPushTool = {
     let stateSnapshot
     let draftsResult
     try {
-      local = await readLocalEffectiveState(rootDir)
+      local = await readLocalEffectiveState(rootDir, targetProjectId)
     } catch (e) {
       return {
         success: false,

package/src/tools/sync/test-endpoint.js

@@ -23,8 +23,7 @@ import { proxyToolCall } from "../proxy.js"
 import { deserializeEndpoint } from "./codec.js"
 import { readLocalConfig, fetchRemoteState } from "./planner.js"
 import {
-  resolveProjectRootFromDypaiDir,
-  runEffectiveWorkflowsCli,
+  runEffectiveWorkflows,
 } from "../../lib/effective-workflows-runner.js"
 import { runValidation } from "./validate.js"
 import { getEnvBoundProjectId } from "../project-context.js"
@@ -94,9 +93,8 @@ async function findEndpointByName(rootDir, name) {
 // or:
 //   { error, hint?, ...debug }   (caller short-circuits with success:false)
 
-async function resolveLocal(rootDir, endpoint, mapsCtx) {
-  const projectRoot = resolveProjectRootFromDypaiDir(rootDir)
-  const effective = runEffectiveWorkflowsCli(projectRoot, ["resolve", "--endpoint", endpoint])
+async function resolveLocal(rootDir, endpoint, mapsCtx, projectId = null) {
+  const effective = await runEffectiveWorkflows(rootDir, projectId, ["resolve", "--endpoint", endpoint])
   if (effective.ok && effective.data?.status === "resolved") {
     const entry = effective.data.entry || {}
     return {
@@ -340,7 +338,7 @@ export const dypaiTestEndpointTool = {
           hint: "Check your DYPAI_TOKEN and that the project_id is correct.",
         }
       }
-      resolved = await resolveLocal(rootDir, endpoint, mapsCtx)
+      resolved = await resolveLocal(rootDir, endpoint, mapsCtx, targetProjectId)
     } else if (mode === "draft") {
       resolved = await resolveDraft(targetProjectId, endpoint)
     } else {

package/src/tools/sync/validate.js

@@ -19,8 +19,7 @@ import { readFile, writeFile, stat } from "fs/promises"
 import { join, resolve as resolvePath } from "path"
 import { fetchRemoteState, readLocalState, readLocalConfig, readLocalRealtime } from "./planner.js"
 import {
-  resolveProjectRootFromDypaiDir,
-  runEffectiveWorkflowsCli,
+  runEffectiveWorkflows,
 } from "../../lib/effective-workflows-runner.js"
 import { proxyToolCall } from "../proxy.js"
 import { getEnvBoundProjectId } from "../project-context.js"
@@ -2206,8 +2205,7 @@ export async function runValidation(rootDir, projectId) {
     })
   }
 
-  const projectRoot = resolveProjectRootFromDypaiDir(rootDir)
-  const flowValidation = runEffectiveWorkflowsCli(projectRoot, ["validate"])
+  const flowValidation = await runEffectiveWorkflows(rootDir, targetProjectId, ["validate"])
   let flowFilesChecked = 0
   let effectiveEndpoints = 0
   if (flowValidation.ok) {
@@ -2215,7 +2213,7 @@ export async function runValidation(rootDir, projectId) {
       ? flowValidation.data.diagnostics
       : []
     diagnostics.push(...flowDiagnostics)
-    const listResult = runEffectiveWorkflowsCli(projectRoot, ["list"])
+    const listResult = await runEffectiveWorkflows(rootDir, targetProjectId, ["list"])
     if (listResult.ok && Array.isArray(listResult.data?.entries)) {
       effectiveEndpoints = listResult.data.entries.length
       flowFilesChecked = listResult.data.entries.filter(e => e.source === "flow").length