@geraldmaron/construct 1.2.3 → 1.3.0

package/lib/integrations/intake-integrations.mjs

@@ -19,6 +19,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { configDir } from '../config/xdg.mjs';
+import { resolveOpRef } from '../providers/secret-resolver.mjs';
 
 // ── Multi-method auth helpers ────────────────────────────────────────────
 
@@ -628,8 +629,7 @@ function resolveCredentialSync(varName, homeDir) {
       const opMatch = content.match(opRe);
       if (opMatch) {
         try {
-          const result = spawnSync('op', ['read', opMatch[1]], { encoding: 'utf8', timeout: 5000 });
-          if (result.status === 0) return result.stdout.trim();
+          return resolveOpRef(opMatch[1]);
         } catch { /* op read failed */ }
       }
     }
@@ -730,16 +730,15 @@ function resolveCredential(varName, homeDir) {
         const opRe = new RegExp(`export\\s+${varName}=["']?\\$\\(op read '([^']+)'\\)["']?`, 'm');
         const opMatch = content.match(opRe);
         if (opMatch) {
+          // op read failures often mean the rc-file field name doesn't match the
+          // actual 1Password item field; surface them under the debug flag.
           try {
-            const result = spawnSync('op', ['read', opMatch[1]], { encoding: 'utf8', timeout: 5000 });
-            if (result.status === 0) return result.stdout.trim();
-            // Log op read failures — often the field name in the rc file
-            // doesn't match the actual 1Password item field name.
-            const errMsg = (result.stderr || '').trim().slice(0, 200);
-            if (errMsg && process.env.CONSTRUCT_DEBUG_CREDENTIALS === '1') {
-              process.stderr.write(`[credentials] op read failed for ${varName}: ${errMsg}\n`);
+            return resolveOpRef(opMatch[1]);
+          } catch (err) {
+            if (process.env.CONSTRUCT_DEBUG_CREDENTIALS === '1') {
+              process.stderr.write(`[credentials] op read failed for ${varName}: ${String(err.message).slice(0, 200)}\n`);
             }
-          } catch { /* op read failed */ }
+          }
         }
 
         // If the value uses command substitution ($(...)), try evaluating via

package/lib/knowledge/research-store.mjs

@@ -18,7 +18,7 @@
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { syncFileStateToSql } from '../storage/sync.mjs';
-import { resolveActiveProfile } from '../profiles/loader.mjs';
+import { resolveActiveScope } from '../scopes/loader.mjs';
 import { ensureCxDir } from '../project-init-shared.mjs';
 
 const ROOT = '.cx/knowledge/external/research';
@@ -64,7 +64,7 @@ export async function addResearchFinding({
     throw new Error('addResearchFinding: confidence=confirmed requires at least one source');
   }
 
-  const profile = resolveActiveProfile(cwd);
+  const profile = resolveActiveScope(cwd);
   const now = new Date();
   const expiresAt = new Date(now.getTime() + ttlDays * 24 * 60 * 60 * 1000).toISOString();
 

package/lib/mcp/server.mjs

@@ -3,7 +3,7 @@
  * lib/mcp/server.mjs — Construct MCP server: tool registry and request dispatcher.
  *
  * Thin dispatcher only — all tool implementations live in lib/mcp/tools/*.mjs.
- * Registers 52 tools across 8 modules: project, document, storage, skills, workflow, telemetry, memory, profile.
+ * Registers 52 tools across 8 modules: project, document, storage, skills, workflow, telemetry, memory, scope.
  * Consumed by Claude Code, OpenCode, and any MCP-compatible host.
  */
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
@@ -38,7 +38,7 @@ import {
 } from './tools/storage.mjs';
 import {
   listSkills, getSkill, searchSkills, getTemplate, listTemplates,
-  agentContract, brokerCheck, orchestrationPolicy, workerRun, listTeams, getTeam,
+  agentContract, brokerCheck, orchestrationPolicy, workerRun, listTeams, getTeam, suggestSkillsTool,
 } from './tools/skills.mjs';
 import {
   workflowInit, workflowAddTask, workflowUpdateTask,
@@ -53,12 +53,15 @@ import {
   sessionList, sessionLoad, sessionSearch, sessionSave, rovoSearch,
 } from './tools/memory.mjs';
 import {
-  profileShow, profileList, profileDrafts, profileHealthTool,
+  scopeShow, scopeList, scopeDrafts, scopeHealthTool,
   outcomesSummary, outcomesRecord, knowledgeAdd,
-  profileCreate, profileArchive, sandboxList, learningStatus,
+  scopeCreate, scopeArchive, sandboxList, learningStatus,
   knowledgeGraphAsk,
-} from './tools/profile.mjs';
+} from './tools/scope.mjs';
 import { modelResolve, triageRecommend, workflowInvoke, capabilityDescribe, executionResolve, artifactWorkflow } from './tools/embedded-contract.mjs';
+import { authorArtifact } from './tools/artifact-author.mjs';
+import { findTool } from './tools/find-tool.mjs';
+import { recoverToolName, recordToolNameMiss, isGatewayName } from './tool-recovery.mjs';
 
 const DEFAULT_ROOT_DIR = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
 const ROOT_DIR = resolve(process.env.CX_TOOLKIT_DIR || DEFAULT_ROOT_DIR);
@@ -470,11 +473,11 @@ const ALL_TOOL_DEFS = [
     },
     {
       name: 'broker_check',
-      description: 'Queries the MCP broker policy gate for a pending action without executing it. Agents call this BEFORE attempting a high-risk action so the response (allowed / approvalRequired / reason / source) can be surfaced to the user in the agent\'s voice rather than triggering a denial after the fact. In solo mode the broker is off by default — returns `brokerActive: false` with `allowed: true` so the call is cheap and agents don\'t waste tokens on an inactive gate. Always emits a `tool.called` trace event for audit-trail parity. Reads specialists/role-manifests.json fence rules in team / enterprise mode.',
+      description: 'Queries the MCP broker policy gate for a pending action without executing it. Agents call this BEFORE attempting a high-risk action so the response (allowed / approvalRequired / reason / source) can be surfaced to the user in the agent\'s voice rather than triggering a denial after the fact. In solo mode the broker is off by default — returns `brokerActive: false` with `allowed: true` so the call is cheap and agents don\'t waste tokens on an inactive gate. Always emits a `tool.called` trace event for audit-trail parity. Reads specialists/org fence rules in team / enterprise mode.',
       inputSchema: {
         type: 'object',
         properties: {
-          role: { type: 'string', description: 'Persona name (e.g. `engineer`, `security`). Must match a key in specialists/role-manifests.json for team / enterprise mode.' },
+          role: { type: 'string', description: 'Persona name (e.g. `engineer`, `security`). Must match a key in specialists/org for team / enterprise mode.' },
           project: { type: 'string', description: 'Optional project scope for the decision.' },
           tool: { type: 'string', description: 'The tool the agent wants to invoke (e.g. `github`, `fs`).' },
           action: { type: 'string', description: 'The action on that tool (e.g. `create_pr`, `edit:lib/foo.mjs`).' },
@@ -486,7 +489,7 @@ const ALL_TOOL_DEFS = [
     },
     {
       name: 'agent_contract',
-      description: 'Looks up explicit agent-to-agent service contracts (from specialists/contracts.json). Specialists should call this at the start of a handoff to see the expected input shape, preconditions, and what postconditions they must satisfy. Use without args to get all contracts; pass producer/consumer to narrow; pass id for a specific contract.',
+      description: 'Looks up explicit agent-to-agent service contracts (from specialists/org). Specialists should call this at the start of a handoff to see the expected input shape, preconditions, and what postconditions they must satisfy. Use without args to get all contracts; pass producer/consumer to narrow; pass id for a specific contract.',
       inputSchema: {
         type: 'object',
         properties: {
@@ -496,6 +499,18 @@ const ALL_TOOL_DEFS = [
         },
       },
     },
+    {
+      name: 'find_tool',
+      description: 'Find Construct tools by intent when you do not know the exact name. Describe what you want to do; returns the best-matching tools with their input schemas, ranked by hybrid semantic + lexical relevance. Then invoke a result via the `call` gateway (or directly if it is a flat tool).',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          query: { type: 'string', description: 'Natural-language description of the task (e.g. "export a markdown file to pdf").' },
+          limit: { type: 'number', description: 'Max tools to return (default 5, max 20).' },
+        },
+        required: ['query'],
+      },
+    },
     {
       name: 'get_template',
       description: 'Reads a doc template by name (e.g. "prd", "meta-prd", "prfaq", "evidence-brief", "adr", "runbook"). Resolves .cx/templates/docs/{name}.md first, then templates/docs/{name}.md.',
@@ -529,14 +544,16 @@ const ALL_TOOL_DEFS = [
       inputSchema: { type: 'object', properties: {} },
     },
     {
-      name: 'get_team',
-      description: 'Returns the full definition of a named team template including members, skills, and promotion gates.',
+      name: 'suggest_skills',
+      description: 'Rank skills from the central catalog for a natural-language intent. Optional specialistId filters entitlement metadata.',
       inputSchema: {
         type: 'object',
         properties: {
-          name: { type: 'string', description: 'Team template name (e.g. feature, incident, architecture).' },
+          intent: { type: 'string', description: 'Task description or keywords' },
+          specialistId: { type: 'string', description: 'Optional cx-* id for entitlement hints' },
+          limit: { type: 'number', description: 'Max suggestions (default 5)' },
         },
-        required: ['name'],
+        required: ['intent'],
       },
     },
     {
@@ -757,41 +774,43 @@ const ALL_TOOL_DEFS = [
         properties: {
           query: { type: 'string', description: 'The user\'s question or the project/repo name (e.g. "project iverson", "hashicorp/project-iverson", "PLAT"). The tool matches this against configured GITHUB_REPOS, JIRA_PROJECTS, LINEAR_TEAMS.' },
           root_dir: { type: 'string', description: 'Data root dir override (default: homedir()). Use CX_DATA_DIR value if set.' },
+          team_id: { type: 'string', description: 'Optional team id (from the unified registry). Scopes the fetch to that team\'s declared sources; observations are tagged team:<id>.' },
+          target_ids: { type: 'array', items: { type: 'string' }, description: 'Optional source-target ids to restrict to (must belong to team_id). A target outside the team returns a typed OUT_OF_SCOPE error rather than a silent wrong-source fetch.' },
         },
       },
     },
     {
-      name: 'profile_show',
-      description: 'Return the active Construct org profile (id, displayName, roles, departments, intake taxonomy, doc templates). Use when a specialist needs to know which role set, classification taxonomy, or doc templates apply before drafting work.',
+      name: 'scope_show',
+      description: 'Return the active Construct scope (id, displayName, roles, departments, intake taxonomy, doc templates). Use when a specialist needs to know which role set, classification taxonomy, or doc templates apply before drafting work.',
       inputSchema: {
         type: 'object',
         properties: {
           cwd: { type: 'string', description: 'Project root (default: server cwd).' },
-          id: { type: 'string', description: 'Force a specific profile id instead of resolving from config.' },
+          id: { type: 'string', description: 'Force a specific scope id instead of resolving from config.' },
         },
       },
     },
     {
-      name: 'profile_list',
-      description: 'List the curated org profile catalog (rnd, operations, creative, research) with role/department counts. Use to discover which profiles are available before suggesting `construct profile set`.',
+      name: 'scope_list',
+      description: 'List the curated org scope catalog (rnd, operations, creative, research) with role/department counts. Use to discover which scopes are available before suggesting `construct scope set`.',
       inputSchema: { type: 'object', properties: {} },
     },
     {
-      name: 'profile_drafts',
-      description: 'List in-progress draft profiles under `.cx/profiles/draft-*` and any user-defined custom profile at `.cx/profile.json`. Use to see what profile work is pending before scaffolding another draft.',
+      name: 'scope_drafts',
+      description: 'List in-progress draft scopes under `.cx/scopes/draft-*` and any user-defined custom scope at `.cx/scope.json`. Use to see what scope work is pending before scaffolding another draft.',
       inputSchema: {
         type: 'object',
         properties: { cwd: { type: 'string', description: 'Project root (default: server cwd).' } },
       },
     },
     {
-      name: 'profile_health',
-      description: 'Per-profile health rollup over a window: observation count, per-role outcome runs and success rates. Use to check whether a profile is producing data before recommending changes or archive.',
+      name: 'scope_health',
+      description: 'Per-scope health rollup over a window: observation count, per-role outcome runs and success rates. Use to check whether a scope is producing data before recommending changes or archive.',
       inputSchema: {
         type: 'object',
         properties: {
           cwd: { type: 'string', description: 'Project root (default: server cwd).' },
-          id: { type: 'string', description: 'Profile id (default: active profile).' },
+          id: { type: 'string', description: 'Scope id (default: active scope).' },
           window_days: { type: 'number', description: 'Window in days (default 30).' },
         },
       },
@@ -819,7 +838,7 @@ const ALL_TOOL_DEFS = [
           role: { type: 'string', description: 'Specialist id (e.g. cx-engineer, product-manager).' },
           success: { type: 'boolean' },
           intake_id: { type: 'string' },
-          profile: { type: 'string', description: 'Override active profile id stamp.' },
+          profile: { type: 'string', description: 'Override active scope id stamp.' },
           escalated: { type: 'boolean' },
           duration_ms: { type: 'number' },
           notes: { type: 'string', description: 'Trimmed to 500 chars.' },
@@ -829,7 +848,7 @@ const ALL_TOOL_DEFS = [
     },
     {
       name: 'knowledge_add',
-      description: 'Persist a research finding as `.cx/knowledge/external/research/<slug>.md` with research-specific frontmatter (topic, confidence, sources, expiresAt, profile). Writes durable state — requires `confirm=true`. `confidence=confirmed` requires at least one source.',
+      description: 'Persist a research finding as `.cx/knowledge/external/research/<slug>.md` with research-specific frontmatter (topic, confidence, sources, expiresAt, scope). Writes durable state — requires `confirm=true`. `confidence=confirmed` requires at least one source.',
       inputSchema: {
         type: 'object',
         required: ['confirm', 'slug', 'topic', 'body'],
@@ -858,15 +877,15 @@ const ALL_TOOL_DEFS = [
       },
     },
     {
-      name: 'profile_create',
-      description: 'Scaffold a draft org profile under `.cx/profiles/draft-<id>/` (requirements.md + profile.json + persona stubs + department charters). Writes durable state — requires `confirm=true`. For curated catalog work, follow `docs/guides/concepts/profile-lifecycle.md` after creation.',
+      name: 'scope_create',
+      description: 'Scaffold a draft org scope under `.cx/scopes/draft-<id>/` (requirements.md + scope.json + persona stubs + department charters). Writes durable state — requires `confirm=true`. For curated catalog work, follow `docs/guides/concepts/scope-lifecycle.md` after creation.',
       inputSchema: {
         type: 'object',
         required: ['confirm', 'id'],
         properties: {
           confirm: { type: 'boolean', description: 'Must be true.' },
           cwd: { type: 'string' },
-          id: { type: 'string', description: 'Profile id (^[a-z][a-z0-9-]{1,30}$).' },
+          id: { type: 'string', description: 'Scope id (^[a-z][a-z0-9-]{1,30}$).' },
           display_name: { type: 'string' },
           seed_roles: {
             type: 'array',
@@ -889,8 +908,8 @@ const ALL_TOOL_DEFS = [
       },
     },
     {
-      name: 'profile_archive',
-      description: 'Archive a curated profile: moves `profiles/<id>.json` and its intake table into `archive/profiles/<id>/` with an archive note. Destructive — requires `confirm=true` and a substantive `reason` (>=8 chars). Observations and outcomes are preserved.',
+      name: 'scope_archive',
+      description: 'Archive a curated scope: moves `specialists/org/scopes/<id>.json` and its intake table into `archive/scopes/<id>/` with an archive note. Destructive — requires `confirm=true` and a substantive `reason` (>=8 chars). Observations and outcomes are preserved.',
       inputSchema: {
         type: 'object',
         required: ['confirm', 'id', 'reason'],
@@ -924,7 +943,7 @@ const ALL_TOOL_DEFS = [
     },
     {
       name: 'learning_status',
-      description: 'One-shot mirror of `npm run learning:status`: active profile, observation counts (last 24h + total), research finding count, per-role outcome rollup. Use to answer "is Construct learning?" without spawning a shell.',
+      description: 'One-shot mirror of `npm run learning:status`: active scope, observation counts (last 24h + total), research finding count, per-role outcome rollup. Use to answer "is Construct learning?" without spawning a shell.',
       inputSchema: {
         type: 'object',
         properties: { cwd: { type: 'string', description: 'Project root (default: server cwd).' } },
@@ -947,14 +966,13 @@ const ALL_TOOL_DEFS = [
     },
     {
       name: 'publish_detect',
-      description: 'Detect availability of publish pipeline tooling: Pandoc/Typst export, pandoc-ext/diagram figures, VHS terminal demos, and Playwright dashboard demos.',
+      description: 'Detect availability of publish pipeline tooling: Pandoc/Typst export, pandoc-ext/diagram figures, and VHS terminal demos.',
       inputSchema: {
         type: 'object',
         properties: {
           format: { type: 'string', enum: ['pdf', 'docx', 'doc', 'deck', 'pptx', 'html', 'rtf', 'odt', 'epub', 'tex', 'txt', 'md', 'mdx'], description: 'Export format to probe (default pdf).' },
           figures: { type: 'boolean', description: 'Include figure binaries (default true).' },
           demo: { type: 'string', description: 'When set, require VHS/asciinema for terminal demo.' },
-          dashboard_demo: { type: 'string', description: 'When set, require Playwright workspace for dashboard demo.' },
         },
       },
     },
@@ -969,7 +987,6 @@ const ALL_TOOL_DEFS = [
           output_path: { type: 'string', description: 'Optional output path for export.' },
           format: { type: 'string', enum: ['pdf', 'docx', 'doc', 'deck', 'pptx', 'html', 'rtf', 'odt', 'epub', 'tex', 'txt', 'md', 'mdx'], description: 'Target format (default pdf).' },
           demo: { type: 'string', description: 'Terminal tape name to record.' },
-          dashboard_demo: { type: 'string', description: 'Dashboard Playwright demo spec basename.' },
           figures: { type: 'boolean', description: 'Render diagrams (default true).' },
           strict: { type: 'boolean', description: 'Fail when toolchain or release gate fails (default true).' },
           source_only: { type: 'boolean', description: 'Write sources only (default false).' },
@@ -1088,7 +1105,7 @@ const ALL_TOOL_DEFS = [
     },
     {
       name: 'workflow_contract_validate',
-      description: 'Validate a producer→consumer handoff against specialists/contracts.json. Required when a specialist hands off to another role: enforces input.mustContain, output schema, disk-artifact postconditions, and binary postconditions per producer (rubber-stamp prevention, post-hoc threat-model prevention, etc.). Self-enforcing: a producer with binary rules MUST pass `packet`, or the call itself is a contract violation.',
+      description: 'Validate a producer→consumer handoff against specialists/org. Required when a specialist hands off to another role: enforces input.mustContain, output schema, disk-artifact postconditions, and binary postconditions per producer (rubber-stamp prevention, post-hoc threat-model prevention, etc.). Self-enforcing: a producer with binary rules MUST pass `packet`, or the call itself is a contract violation.',
       inputSchema: {
         type: 'object',
         required: ['producer', 'consumer'],
@@ -1151,6 +1168,19 @@ const ALL_TOOL_DEFS = [
         },
       },
     },
+    {
+      name: 'author_artifact',
+      description: 'Materialize a typed Construct artifact you have drafted (prd, prd-platform, prd-business, meta-prd, adr, rfc, research-brief, evidence-brief, runbook) to disk and run the release gate. YOU draft the full markdown — start with a single # title and include the type\'s required ## sections (call get_template first for the shape) — and pass it as draft_markdown; the canonical file is written and the gate verdict + errors are returned so you can fix and re-call. This is the Construct author→materialize→validate pass for supported hosts.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          draft_markdown: { type: 'string', description: 'The complete artifact markdown you authored. Must start with one # title line and contain the required ## sections for the type.' },
+          artifact_type: { type: 'string', description: 'Artifact type (prd, meta-prd, adr, rfc, research-brief, evidence-brief, runbook, …). Defaults to prd; inferred from subject when omitted.' },
+          subject: { type: 'string', description: 'Short subject/title hint (e.g. "OIDC integration") used for the filename and type inference.' },
+        },
+        required: ['draft_markdown'],
+      },
+    },
     {
       name: 'model_resolve',
       description: 'Resolve which model an embedded Construct workflow should use given the host/IDE provider context. Precedence: host model → same-provider-family fallback → Construct tier default → structured config error. Never reads or returns credential values (requiresCredential is a boolean) and never claims unverified provider health. Read-only; performs no writes.',
@@ -1235,7 +1265,7 @@ const ALL_TOOL_DEFS = [
     },
     {
       name: 'orchestration_run',
-      description: 'EXECUTE a real multi-specialist orchestration run via the local Construct daemon and return per-specialist output — the executing counterpart to workflow_invoke (which only plans). For MCP hosts with no subagent primitive (VS Code/Copilot, Cursor), this is how you actually run a specialist chain: the engine owns orchestration, this tool is the thin client (ADR-0022). Requires a running daemon (`construct dashboard`); if it is unreachable the tool fails fast with how to start it rather than silently degrading to a single-persona pass. Real specialist output requires the daemon to run the `provider` worker backend (a provider key configured); the default `inline` backend prepares tasks only.',
+      description: 'EXECUTE a real multi-specialist orchestration run and return per-specialist output — the executing counterpart to workflow_invoke (which only plans). For MCP hosts with no subagent primitive (VS Code/Copilot, Cursor), this is how you actually run a specialist chain: the engine owns orchestration, this tool is the thin client (ADR-0022). Solo runs execute in-process — no daemon, no port, no token; a remote/team orchestration service is opt-in via CONSTRUCT_ORCHESTRATION_URL. Real specialist output requires the `provider` worker backend (a provider key configured); the default `inline` backend prepares tasks only.',
       inputSchema: {
         type: 'object',
         required: ['request'],
@@ -1273,17 +1303,14 @@ const ALL_TOOL_DEFS = [
 // host/model; the long tail is reachable, just not front-loaded.
 
 const CORE_TOOL_NAMES = new Set([
-  'orchestration_policy', 'get_skill', 'search_skills', 'knowledge_search',
-  'memory_search', 'project_context', 'summarize_diff',
+  'orchestration_policy', 'get_skill', 'get_template', 'search_skills', 'knowledge_search',
+  'memory_search', 'project_context', 'summarize_diff', 'find_tool',
+  'author_artifact', 'document_export', 'publish_run', 'artifact_workflow',
+  'workflow_invoke', 'triage_recommend',
 ]);
 
-function firstSentence(text) {
-  const s = String(text || '').replace(/\s+/g, ' ').trim();
-  const end = s.search(/\.(\s|$)/);
-  return (end > 0 ? s.slice(0, end) : s).slice(0, 140);
-}
-
 const LONG_TAIL_DEFS = ALL_TOOL_DEFS.filter((t) => !CORE_TOOL_NAMES.has(t.name));
+const KNOWN_TOOL_NAMES = new Set(ALL_TOOL_DEFS.map((t) => t.name));
 
 // One dispatcher for the long tail. `tool` is constrained to an enum of valid
 // names (≈1 token each — kills hallucinated names, the key small-model lever),
@@ -1291,11 +1318,12 @@ const LONG_TAIL_DEFS = ALL_TOOL_DEFS.filter((t) => !CORE_TOOL_NAMES.has(t.name))
 // schemas. Dispatch reuses the same handlers via dispatchToolByName.
 
 const CONSTRUCT_CALL_TOOL = {
-  name: 'construct_call',
+  name: 'call',
   description:
-    'Invoke any non-core Construct tool by name. Put the tool name in `tool` and its arguments in `args`. '
-    + 'Available tools:\n'
-    + LONG_TAIL_DEFS.map((t) => `- ${t.name} — ${firstSentence(t.description)}`).join('\n'),
+    'Invoke any non-core Construct tool by name: provide `tool` and `args`. '
+    + 'If you do not know the exact name, call find_tool with a description of your task to get ranked tools and their schemas. '
+    + `Long-tail tool groups: ${[...new Set(LONG_TAIL_DEFS.map((t) => t.name.split('_')[0]))].sort().map((g) => `${g}_*`).join(', ')}. `
+    + 'The `tool` value must be a catalog name (constrained by the enum below).',
   inputSchema: {
     type: 'object',
     properties: {
@@ -1349,7 +1377,7 @@ export async function dispatchToolByName(name, args = {}) {
     else if (name === 'workflow_contract_validate') result = await workflowContractValidate(args);
     else if (name === 'workflow_import_plan') result = workflowImportPlan(args);
     else if (name === 'list_teams') result = listTeams(opts);
-    else if (name === 'get_team') result = getTeam(args, opts);
+    else if (name === 'suggest_skills') result = suggestSkillsTool(args, opts);
     else if (name === 'cx_trace_telemetry') { const m = await import('./tools/telemetry.mjs'); result = await m.cxTrace(args, opts); }
     else if (name === 'cx_trace') result = await cxTrace(args, opts);
     else if (name === 'cx_score') result = await cxScore(args);
@@ -1367,7 +1395,7 @@ export async function dispatchToolByName(name, args = {}) {
     else if (name === 'session_usage') result = await sessionUsage(args, opts);
     else if (name === 'provider_fetch') {
       const { demandFetch } = await import('../embed/demand-fetch.mjs');
-      result = await demandFetch({ query: args.query, rootDir: args.root_dir });
+      result = await demandFetch({ query: args.query, rootDir: args.root_dir, teamId: args.team_id, targetIds: args.target_ids });
     }
     else if (name === 'knowledge_search') {
       const { knowledgeSearch } = await import('../knowledge/search.mjs');
@@ -1392,7 +1420,6 @@ export async function dispatchToolByName(name, args = {}) {
         format: args.format || 'pdf',
         includeFigures: args.figures !== false,
         includeTerminalDemo: Boolean(args.demo),
-        includeDashboardDemo: Boolean(args.dashboard_demo),
       });
     }
     else if (name === 'publish_run') {
@@ -1403,7 +1430,6 @@ export async function dispatchToolByName(name, args = {}) {
           format: args.format || 'pdf',
           includeFigures: args.figures !== false,
           includeTerminalDemo: Boolean(args.demo),
-          includeDashboardDemo: Boolean(args.dashboard_demo),
         });
       } else {
         result = runPublish({
@@ -1411,7 +1437,6 @@ export async function dispatchToolByName(name, args = {}) {
           format: args.format || 'pdf',
           outputPath: args.output_path,
           demos: args.demo ? [args.demo] : [],
-          dashboardDemos: args.dashboard_demo ? [args.dashboard_demo] : [],
           figures: args.figures !== false,
           strict: args.strict !== false,
           gate: args.no_gate !== true,
@@ -1421,15 +1446,15 @@ export async function dispatchToolByName(name, args = {}) {
         });
       }
     }
-    else if (name === 'profile_show') result = profileShow(args);
-    else if (name === 'profile_list') result = profileList();
-    else if (name === 'profile_drafts') result = profileDrafts(args);
-    else if (name === 'profile_health') result = profileHealthTool(args);
+    else if (name === 'scope_show') result = scopeShow(args);
+    else if (name === 'scope_list') result = scopeList();
+    else if (name === 'scope_drafts') result = scopeDrafts(args);
+    else if (name === 'scope_health') result = scopeHealthTool(args);
     else if (name === 'outcomes_summary') result = outcomesSummary(args);
     else if (name === 'outcomes_record') result = outcomesRecord(args);
     else if (name === 'knowledge_add') result = await knowledgeAdd(args);
-    else if (name === 'profile_create') result = profileCreate(args);
-    else if (name === 'profile_archive') result = profileArchive(args);
+    else if (name === 'scope_create') result = scopeCreate(args);
+    else if (name === 'scope_archive') result = scopeArchive(args);
     else if (name === 'sandbox_list') result = sandboxList();
     else if (name === 'learning_status') result = learningStatus(args);
     else if (name === 'knowledge_graph_ask') result = knowledgeGraphAsk(args);
@@ -1439,17 +1464,35 @@ export async function dispatchToolByName(name, args = {}) {
     else if (name === 'capability_describe') result = capabilityDescribe(args);
     else if (name === 'construct_execution_resolve') result = executionResolve(args);
     else if (name === 'artifact_workflow') result = artifactWorkflow(args);
+    else if (name === 'author_artifact') result = await authorArtifact(args, opts);
+    else if (name === 'find_tool') result = await findTool(args, { toolDefs: ALL_TOOL_DEFS, env: process.env });
     else if (name === 'orchestration_run') { const m = await import('./tools/orchestration-run.mjs'); result = await m.orchestrationRun(args); }
     else if (name === 'orchestration_status') { const m = await import('./tools/orchestration-run.mjs'); result = await m.orchestrationStatus(args); }
-    else if (name === 'construct_call') {
+    else if (name === 'call') {
       const inner = String(args?.tool || '');
-      if (!inner || inner === 'construct_call') result = { error: "construct_call requires a 'tool' name (not 'construct_call')" };
+      if (!inner || isGatewayName(inner)) result = { error: "call requires a 'tool' name to invoke (e.g. { tool: 'document_export', args: {…} })" };
       else result = await dispatchToolByName(inner, args?.args || {});
     }
-    else result = { error: `Unknown tool: ${name}` };
+    else result = await resolveUnknownToolName(name, args);
   return result;
 }
 
+// The agent reached for a name no branch matches. Recover the obvious cases (the
+// gateway under an alias, a known tool wearing the host prefix) and record every
+// miss so the discoverability gap is measurable instead of silent.
+
+async function resolveUnknownToolName(name, args = {}) {
+  const recovered = recoverToolName(name, KNOWN_TOOL_NAMES);
+  recordToolNameMiss(ROOT_DIR, { name, recovered: recovered?.name || (recovered?.gateway ? 'call' : null) });
+  if (recovered?.gateway) {
+    const inner = String(args?.tool || '');
+    if (!inner || isGatewayName(inner)) return { error: "call requires a 'tool' name to invoke (e.g. { tool: 'document_export', args: {…} })" };
+    return dispatchToolByName(inner, args?.args || {});
+  }
+  if (recovered?.name) return dispatchToolByName(recovered.name, args);
+  return { error: `Unknown tool: ${name}. Core tools are flat; invoke any other tool via { name: 'call', arguments: { tool: '<name>', args: {…} } }.` };
+}
+
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
   const { name, arguments: args = {} } = request.params;
 

package/lib/mcp/tool-budget.mjs

@@ -8,9 +8,7 @@
  *   2. which external MCP servers are `enabled` in opencode.json — sync disables
  *      the heavy ones for local-capable setups (they cannot be trimmed at runtime).
  * Holds the shared token-sizing helper and the external-server id list both
- * levers reason about, plus the owned-loop tool-budget filter that trims the
- * Vercel AI SDK tool set to a compiled execution policy's allowed groups and
- * schema cap (lib/models/execution-policy.mjs).
+ * levers reason about.
  */
 
 import { getMeasuredHeavyExternalMcpTokenCost } from './external-schema-cost.mjs';
@@ -59,46 +57,3 @@ export function estimateToolTokens(tools) {
 }
 
 export { getMeasuredHeavyExternalMcpTokenCost };
-
-// Maps the owned loop's agent tool names (apps/chat/engine/tools/registry.mjs)
-// onto the execution-policy tool groups (lib/models/execution-policy.mjs) so a
-// compiled policy can trim the serialized tool surface for a capability-
-// constrained model. construct_tool is the single MCP gateway, so it stands in
-// for the whole 'construct' group. An unrecognized name falls back to
-// 'construct' — a group present in every tier — so an unclassified tool is never
-// silently dropped from a constrained surface.
-
-const AGENT_TOOL_GROUPS = Object.freeze({
-  read: 'read',
-  glob: 'search',
-  grep: 'search',
-  write: 'edit',
-  edit: 'edit',
-  shell: 'shell',
-  construct_tool: 'construct',
-});
-
-export function toolGroupForName(name) {
-  return AGENT_TOOL_GROUPS[name] || 'construct';
-}
-
-// Trim a tool set to the compiled policy's envelope: drop any tool whose group is
-// outside allowedToolGroups, then cap the survivors at maxToolSchemas in stable
-// insertion order. A null allowedToolGroups means "no group filter" and an
-// unbounded cap means "no count limit", so the rich/hosted-direct envelope (all
-// groups, cap 32) returns the input set unchanged.
-
-export function applyToolBudget(tools, { allowedToolGroups = null, maxToolSchemas = Infinity } = {}) {
-  if (!tools || typeof tools !== 'object') return tools;
-  const allow = Array.isArray(allowedToolGroups) ? new Set(allowedToolGroups) : null;
-  const cap = Number.isFinite(maxToolSchemas) ? Math.max(0, Math.floor(maxToolSchemas)) : Infinity;
-  const out = {};
-  let kept = 0;
-  for (const [name, def] of Object.entries(tools)) {
-    if (allow && !allow.has(toolGroupForName(name))) continue;
-    if (kept >= cap) break;
-    out[name] = def;
-    kept += 1;
-  }
-  return out;
-}

package/lib/mcp/tool-recovery.mjs

@@ -0,0 +1,44 @@
+/**
+ * lib/mcp/tool-recovery.mjs — Tolerant dispatch fallback + tool-name-miss telemetry.
+ *
+ * Hosts and models routinely mis-name Construct tools: the `call` gateway under
+ * its former `construct_call` name, a long-tail tool invoked directly, or a name
+ * carrying a stray `construct-mcp_` host prefix. Recovering the intent when it is
+ * unambiguous keeps work flowing; recording every miss closes a discoverability
+ * blind spot — calls rejected at the host's tool-validation layer never reach the
+ * server, so without this record those failures stay invisible to Construct.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+
+const GATEWAY_NAMES = new Set(['call', 'construct_call']);
+
+function stripHostPrefix(name) {
+  return String(name || '').replace(/^construct[-_]mcp[-_]/i, '');
+}
+
+export function isGatewayName(name) {
+  return GATEWAY_NAMES.has(name) || GATEWAY_NAMES.has(stripHostPrefix(name));
+}
+
+// Resolve an unrecognized name to a real target when the intent is unambiguous:
+// a gateway alias, or a known tool wearing the host prefix. Anything else is a
+// genuine miss with no safe recovery.
+
+export function recoverToolName(name, knownNames) {
+  if (isGatewayName(name)) return { gateway: true };
+  const stripped = stripHostPrefix(name);
+  if (stripped !== name && knownNames.has(stripped)) return { name: stripped };
+  return null;
+}
+
+export function recordToolNameMiss(rootDir, { name, recovered = null } = {}) {
+  try {
+    const dir = path.join(rootDir, '.cx', 'observations');
+    fs.mkdirSync(dir, { recursive: true });
+    const line = `${JSON.stringify({ at: new Date().toISOString(), kind: 'tool-name-miss', name, recovered })}\n`;
+    fs.appendFileSync(path.join(dir, 'tool-name-misses.jsonl'), line);
+  } catch {
+    /* telemetry is best-effort; never break dispatch */
+  }
+}

package/lib/mcp/tools/artifact-author.mjs

@@ -0,0 +1,36 @@
+/**
+ * lib/mcp/tools/artifact-author.mjs — MCP `author_artifact` tool.
+ *
+ * OpenCode-reachable author pass: the calling agent is the model and supplies
+ * the drafted typed-artifact markdown,
+ * which gets materialized to its canonical path and run through the release gate.
+ * Returns the path and a structured verdict so the agent can fix and re-call.
+ * allowScaffold stays off — a real draft is required, never an empty scaffold.
+ */
+import { runConstructArtifactLoop } from '../../artifact-loop-core.mjs';
+
+export async function authorArtifact(args = {}, { ROOT_DIR } = {}) {
+  const draftMarkdown = args.draft_markdown || args.draft || '';
+  const cwd = args.cwd || process.cwd();
+  const result = await runConstructArtifactLoop({
+    draftMarkdown,
+    artifactType: args.artifact_type,
+    text: args.subject || args.text || '',
+    cwd,
+    rootDir: ROOT_DIR,
+    explicit: true,
+    allowScaffold: false,
+  });
+
+  return {
+    ok: Boolean(result.ok),
+    artifact_type: result.artifactType,
+    path: result.relPath,
+    written: !result.draftMissing,
+    gate: result.validation?.ok ? 'PASS' : 'FAIL',
+    errors: result.validation?.errors || [],
+    warnings: result.validation?.warnings || [],
+    workflow_plan: (result.invokePlan?.selectedRoles || []).map((r) => `cx-${r}`),
+    summary: result.summary,
+  };
+}