@girardmedia/bootspring 2.7.0 → 3.1.0

package/dist/mcp-server.js

@@ -33,9 +33,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// ../../node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3_yaml@2.8.3/node_modules/tsup/assets/cjs_shims.js
+// ../../node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.14_tsx@4.21.0_typescript@5.9.3_yaml@2.8.3/node_modules/tsup/assets/cjs_shims.js
 var init_cjs_shims = __esm({
-  "../../node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3_yaml@2.8.3/node_modules/tsup/assets/cjs_shims.js"() {
+  "../../node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.14_tsx@4.21.0_typescript@5.9.3_yaml@2.8.3/node_modules/tsup/assets/cjs_shims.js"() {
     "use strict";
   }
 });
@@ -26434,13 +26434,16 @@ var require_data = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.0/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.0/node_modules/fast-uri/lib/utils.js"(exports2, module2) {
+  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js"(exports2, module2) {
     "use strict";
     init_cjs_shims();
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
+    var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
+    var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -26633,27 +26636,77 @@ var require_utils = __commonJS({
       }
       return output.join("");
     }
-    function normalizeComponentEncoding(component, esc) {
-      const func = esc !== true ? escape : unescape;
-      if (component.scheme !== void 0) {
-        component.scheme = func(component.scheme);
-      }
-      if (component.userinfo !== void 0) {
-        component.userinfo = func(component.userinfo);
-      }
-      if (component.host !== void 0) {
-        component.host = func(component.host);
+    var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
+    var HOST_DELIM_RE = /[@/?#:]/g;
+    var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
+    function reescapeHostDelimiters(host, isIP) {
+      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+      re.lastIndex = 0;
+      return host.replace(re, (ch) => HOST_DELIMS[ch]);
+    }
+    function normalizePercentEncoding(input, decodeUnreserved = false) {
+      if (input.indexOf("%") === -1) {
+        return input;
       }
-      if (component.path !== void 0) {
-        component.path = func(component.path);
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            const normalizedHex = hex.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (decodeUnreserved && isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        output += input[i];
       }
-      if (component.query !== void 0) {
-        component.query = func(component.query);
+      return output;
+    }
+    function normalizePathEncoding(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            const normalizedHex = hex.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (decoded !== "." && isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        if (isPathCharacter(input[i])) {
+          output += input[i];
+        } else {
+          output += escape(input[i]);
+        }
       }
-      if (component.fragment !== void 0) {
-        component.fragment = func(component.fragment);
+      return output;
+    }
+    function escapePreservingEscapes(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        if (input[i] === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            output += "%" + hex.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        output += escape(input[i]);
       }
-      return component;
+      return output;
     }
     function recomposeAuthority(component) {
       const uriTokens = [];
@@ -26668,7 +26721,7 @@ var require_utils = __commonJS({
           if (ipV6res.isIPV6 === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
-            host = component.host;
+            host = reescapeHostDelimiters(host, false);
           }
         }
         uriTokens.push(host);
@@ -26682,7 +26735,10 @@ var require_utils = __commonJS({
     module2.exports = {
       nonSimpleDomain,
       recomposeAuthority,
-      normalizeComponentEncoding,
+      reescapeHostDelimiters,
+      normalizePercentEncoding,
+      normalizePathEncoding,
+      escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
       isUUID,
@@ -26692,9 +26748,9 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.0/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.0/node_modules/fast-uri/lib/schemes.js"(exports2, module2) {
+  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js"(exports2, module2) {
     "use strict";
     init_cjs_shims();
     var { isUUID } = require_utils();
@@ -26903,17 +26959,17 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.0/node_modules/fast-uri/index.js
+// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.0/node_modules/fast-uri/index.js"(exports2, module2) {
+  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js"(exports2, module2) {
     "use strict";
     init_cjs_shims();
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     function normalize(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
-        serialize(parse(uri, options), options);
+        normalizeString(uri, options);
       } else if (typeof uri === "object") {
         uri = /** @type {T} */
         parse(serialize(uri, options), options);
@@ -26980,19 +27036,9 @@ var require_fast_uri = __commonJS({
       return target;
     }
     function equal(uriA, uriB, options) {
-      if (typeof uriA === "string") {
-        uriA = unescape(uriA);
-        uriA = serialize(normalizeComponentEncoding(parse(uriA, options), true), { ...options, skipEscape: true });
-      } else if (typeof uriA === "object") {
-        uriA = serialize(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true });
-      }
-      if (typeof uriB === "string") {
-        uriB = unescape(uriB);
-        uriB = serialize(normalizeComponentEncoding(parse(uriB, options), true), { ...options, skipEscape: true });
-      } else if (typeof uriB === "object") {
-        uriB = serialize(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true });
-      }
-      return uriA.toLowerCase() === uriB.toLowerCase();
+      const normalizedA = normalizeComparableURI(uriA, options);
+      const normalizedB = normalizeComparableURI(uriB, options);
+      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
     }
     function serialize(cmpts, opts) {
       const component = {
@@ -27017,12 +27063,12 @@ var require_fast_uri = __commonJS({
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
       if (component.path !== void 0) {
         if (!options.skipEscape) {
-          component.path = escape(component.path);
+          component.path = escapePreservingEscapes(component.path);
           if (component.scheme !== void 0) {
             component.path = component.path.split("%3A").join(":");
           }
         } else {
-          component.path = unescape(component.path);
+          component.path = normalizePercentEncoding(component.path);
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
@@ -27057,7 +27103,16 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
-    function parse(uri, opts) {
+    function getParseError(parsed, matches) {
+      if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
+        return 'URI path must start with "/" when authority is present.';
+      }
+      if (typeof parsed.port === "number" && (parsed.port < 0 || parsed.port > 65535)) {
+        return "URI port is malformed.";
+      }
+      return void 0;
+    }
+    function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
         scheme: void 0,
@@ -27068,6 +27123,7 @@ var require_fast_uri = __commonJS({
         query: void 0,
         fragment: void 0
       };
+      let malformedAuthorityOrPort = false;
       let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
@@ -27088,6 +27144,11 @@ var require_fast_uri = __commonJS({
         if (isNaN(parsed.port)) {
           parsed.port = matches[5];
         }
+        const parseError = getParseError(parsed, matches);
+        if (parseError !== void 0) {
+          parsed.error = parsed.error || parseError;
+          malformedAuthorityOrPort = true;
+        }
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
@@ -27126,14 +27187,18 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = unescape(parsed.host);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
             }
           }
           if (parsed.path) {
-            parsed.path = escape(unescape(parsed.path));
+            parsed.path = normalizePathEncoding(parsed.path);
           }
           if (parsed.fragment) {
-            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            try {
+              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            } catch {
+              parsed.error = parsed.error || "URI malformed";
+            }
           }
         }
         if (schemeHandler && schemeHandler.parse) {
@@ -27142,7 +27207,29 @@ var require_fast_uri = __commonJS({
       } else {
         parsed.error = parsed.error || "URI can not be parsed.";
       }
-      return parsed;
+      return { parsed, malformedAuthorityOrPort };
+    }
+    function parse(uri, opts) {
+      return parseWithStatus(uri, opts).parsed;
+    }
+    function normalizeString(uri, opts) {
+      return normalizeStringWithStatus(uri, opts).normalized;
+    }
+    function normalizeStringWithStatus(uri, opts) {
+      const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+      return {
+        normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
+        malformedAuthorityOrPort
+      };
+    }
+    function normalizeComparableURI(uri, opts) {
+      if (typeof uri === "string") {
+        const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
+        return malformedAuthorityOrPort ? void 0 : normalized;
+      }
+      if (typeof uri === "object") {
+        return serialize(uri, opts);
+      }
     }
     var fastUri = {
       SCHEMES,
@@ -31377,7 +31464,7 @@ var init_release = __esm({
   "../../packages/shared/src/release.ts"() {
     "use strict";
     init_cjs_shims();
-    BOOTSPRING_VERSION = "2.7.0";
+    BOOTSPRING_VERSION = "3.1.0";
     BOOTSPRING_PACKAGE_NAME = "@girardmedia/bootspring";
   }
 });
@@ -47601,7 +47688,7 @@ var require_dist2 = __commonJS({
     ));
     var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
     var init_cjs_shims2 = __esm2({
-      "../../node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.8_tsx@4.21.0_typescript@5.9.3_yaml@2.8.3/node_modules/tsup/assets/cjs_shims.js"() {
+      "../../node_modules/.pnpm/tsup@8.5.1_jiti@1.21.7_postcss@8.5.14_tsx@4.21.0_typescript@5.9.3_yaml@2.8.3/node_modules/tsup/assets/cjs_shims.js"() {
         "use strict";
       }
     });
@@ -52278,7 +52365,7 @@ var require_package = __commonJS({
   "../../../package.json"(exports2, module2) {
     module2.exports = {
       name: "bootspring-workspace",
-      version: "2.7.0",
+      version: "3.1.0",
       private: true,
       description: "Workspace tooling for the Bootspring monorepo",
       keywords: [
@@ -52353,6 +52440,7 @@ var require_package = __commonJS({
         "planning:sync:check": "node scripts/sync-planning-state.js --check",
         "planning:realign": "node scripts/sync-planning-state.js --sync-runtime",
         "verify:package": "node scripts/check-package-boundaries.js",
+        "verify:security": "node scripts/security-scan.js",
         "db:sync": "node monorepo/packages/shared/db/sync.js",
         "db:sync:check": "node monorepo/packages/shared/db/sync.js --check"
       },
@@ -52363,12 +52451,15 @@ var require_package = __commonJS({
         "@typescript-eslint/eslint-plugin": "^8.57.0",
         "@typescript-eslint/parser": "^8.57.0",
         "@vitest/coverage-v8": "^4.0.18",
+        ajv: "^8.18.0",
         eslint: "^9.39.2",
         globals: "^17.3.0",
         tsup: "^8.5.1",
         tsx: "^4.21.0",
         typescript: "^5.9.3",
-        vitest: "^4.0.18"
+        vitest: "^4.0.18",
+        yaml: "^2.8.3",
+        zod: "^4.3.6"
       },
       engines: {
         node: ">=18.0.0"
@@ -52378,8 +52469,10 @@ var require_package = __commonJS({
           ajv: "^8.12.0"
         },
         minimatch: "^10.2.1",
-        hono: "4.12.4",
-        "@hono/node-server": "1.19.10",
+        hono: "4.12.18",
+        "@hono/node-server": "1.19.13",
+        axios: ">=1.16.0",
+        "simple-git": ">=3.36.0",
         "express-rate-limit": "^8.2.2",
         "path-to-regexp@<0.1.13": "0.1.13",
         "path-to-regexp@>=8.0.0 <8.4.0": "8.4.0",
@@ -52482,9 +52575,100 @@ function formatBuildTask(task) {
     phase: task.phase,
     source: task.source,
     sourceSection: task.sourceSection,
-    acceptanceCriteria: task.acceptanceCriteria || []
+    acceptanceCriteria: task.acceptanceCriteria || [],
+    dependencies: task.dependencies || []
   };
 }
+function autoCommitTask(taskId, taskTitle) {
+  try {
+    const { execSync } = require("child_process");
+    const cwd = getProjectRoot();
+    const status = execSync("git status --porcelain", { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    if (!status) return { committed: false, reason: "no_changes" };
+    execSync("git add -A", { cwd, stdio: ["ignore", "ignore", "ignore"] });
+    const msg = `feat(${taskId}): ${taskTitle}`;
+    execSync(`git commit -m ${JSON.stringify(msg)}`, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return { committed: true, message: msg };
+  } catch (e) {
+    return { committed: false, reason: "git_error", error: String(e?.message || e).slice(0, 200) };
+  }
+}
+function verifyQuality() {
+  try {
+    const { execSync } = require("child_process");
+    const cwd = getProjectRoot();
+    const fs3 = require("fs");
+    const path3 = require("path");
+    const pkgPath = path3.join(cwd, "package.json");
+    if (!fs3.existsSync(pkgPath)) return { verified: true, skipped: true };
+    const pkg = JSON.parse(fs3.readFileSync(pkgPath, "utf-8"));
+    const hasTest = pkg.scripts?.test;
+    const hasTypecheck = pkg.scripts?.typecheck;
+    const results = { verified: true, checks: [] };
+    if (hasTypecheck) {
+      try {
+        execSync("npm run typecheck 2>&1", { cwd, encoding: "utf8", timeout: 6e4, stdio: ["ignore", "pipe", "pipe"] });
+        results.checks.push({ name: "typecheck", passed: true });
+      } catch (e) {
+        results.checks.push({ name: "typecheck", passed: false, error: String(e?.stdout || e?.message || "").slice(0, 500) });
+        results.verified = false;
+      }
+    }
+    if (hasTest && pkg.devDependencies?.vitest) {
+      try {
+        const changed = execSync("git diff --name-only HEAD 2>/dev/null || true", { cwd, encoding: "utf8" }).trim();
+        const testFiles = changed.split("\n").filter((f) => f.match(/\.(test|spec)\.(ts|js|tsx|jsx)$/));
+        if (testFiles.length > 0) {
+          execSync(`npx vitest run ${testFiles.join(" ")} 2>&1`, { cwd, encoding: "utf8", timeout: 12e4, stdio: ["ignore", "pipe", "pipe"] });
+          results.checks.push({ name: "tests", passed: true, files: testFiles.length });
+        } else {
+          results.checks.push({ name: "tests", passed: true, skipped: true, reason: "no_changed_test_files" });
+        }
+      } catch (e) {
+        results.checks.push({ name: "tests", passed: false, error: String(e?.stdout || e?.message || "").slice(0, 500) });
+        results.verified = false;
+      }
+    }
+    return results;
+  } catch {
+    return { verified: true, skipped: true };
+  }
+}
+function loadHandoff() {
+  const fs3 = require("fs");
+  const path3 = require("path");
+  const handoffPath = path3.join(getProjectRoot(), "planning", ".handoff.json");
+  if (!fs3.existsSync(handoffPath)) return null;
+  try {
+    return JSON.parse(fs3.readFileSync(handoffPath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function saveHandoff(data) {
+  const fs3 = require("fs");
+  const path3 = require("path");
+  const planDir = path3.join(getProjectRoot(), "planning");
+  if (!fs3.existsSync(planDir)) fs3.mkdirSync(planDir, { recursive: true });
+  fs3.writeFileSync(path3.join(planDir, ".handoff.json"), JSON.stringify(data, null, 2));
+}
+function getBatchTasks(state, count) {
+  const q = state?.implementationQueue || [];
+  const pending = [];
+  for (const task of q) {
+    if (task.status !== "pending") continue;
+    if (task.dependencies?.length > 0) {
+      const allDone = task.dependencies.every((depId) => {
+        const dep = q.find((t) => t.id === depId);
+        return dep && dep.status === "completed";
+      });
+      if (!allDone) continue;
+    }
+    pending.push(task);
+    if (pending.length >= count) break;
+  }
+  return pending;
+}
 async function executeLocalBuild(args) {
   const action = args?.action || "status";
   const state = loadBuildState();
@@ -52561,6 +52745,8 @@ async function executeLocalBuild(args) {
       if (!inProgress) {
         return { content: [{ type: "text", text: JSON.stringify({ error: "No task currently in progress", hint: "Use action=next to get a task first" }, null, 2) }] };
       }
+      const quality = args?.verify !== false ? verifyQuality() : { verified: true, skipped: true };
+      const commitResult = args?.autoCommit !== false ? autoCommitTask(inProgress.id, inProgress.title) : { committed: false, reason: "disabled" };
       buildUpdateTaskStatus(state, inProgress.id, "completed");
       const nextTask = buildGetNextTask(state);
       if (nextTask) {
@@ -52570,10 +52756,13 @@ async function executeLocalBuild(args) {
       const stats = buildGetStats(state);
       return { content: [{ type: "text", text: JSON.stringify({
         completed: { id: inProgress.id, title: inProgress.title },
+        commit: commitResult,
+        quality,
         progress: { completed: stats.completed, total: stats.total, percent: stats.percent },
         nextTask: nextTask ? { ...formatBuildTask(nextTask), file: "planning/TODO.md" } : null,
         allComplete: !nextTask,
-        message: nextTask ? `Complete! Next: implement ${nextTask.id} \u2014 ${nextTask.title}` : "Build complete! All tasks finished."
+        state: nextTask ? "advanced" : "all_complete",
+        message: nextTask ? `Done! Committed ${inProgress.id}. Next: ${nextTask.id} \u2014 ${nextTask.title}` : "Build complete! All tasks finished."
       }, null, 2) }] };
     }
     case "skip": {
@@ -52795,8 +52984,66 @@ async function executeLocalBuild(args) {
         message: marked.length > 0 ? `Marked ${marked.length} task${marked.length === 1 ? "" : "s"} as completed from git history` : `Scanned ${lines.length} commits, found ${foundIds.size} bs-IDs, but none matched pending/in-progress tasks`
       }, null, 2) }] };
     }
+    case "handoff": {
+      if (args?.save) {
+        const handoffData = {
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          lastTaskId: args.lastTaskId || null,
+          inProgressTask: state ? (state.implementationQueue || []).find((t) => t.status === "in_progress")?.id || null : null,
+          filesModified: args.filesModified || [],
+          notes: args.notes || "",
+          blockers: args.blockers || [],
+          progress: state ? buildGetStats(state) : null
+        };
+        saveHandoff(handoffData);
+        return { content: [{ type: "text", text: JSON.stringify({
+          saved: true,
+          handoff: handoffData,
+          message: "Session handoff saved. Next session will pick up from here."
+        }, null, 2) }] };
+      }
+      const handoff = loadHandoff();
+      if (!handoff) {
+        return { content: [{ type: "text", text: JSON.stringify({
+          hasHandoff: false,
+          message: "No previous session handoff found. Start fresh with action=next."
+        }, null, 2) }] };
+      }
+      const currentState = state ? buildGetStats(state) : null;
+      return { content: [{ type: "text", text: JSON.stringify({
+        hasHandoff: true,
+        handoff,
+        currentProgress: currentState,
+        message: `Previous session left off at ${handoff.inProgressTask || handoff.lastTaskId || "unknown"}. ${handoff.notes || "No notes."}`,
+        suggestedAction: handoff.inProgressTask ? "action=current to see the in-progress task" : "action=next to continue"
+      }, null, 2) }] };
+    }
+    case "batch": {
+      if (!state) {
+        return { content: [{ type: "text", text: JSON.stringify({ error: "No build state found" }, null, 2) }] };
+      }
+      const count = Math.min(Math.max(args?.count || 5, 1), 10);
+      const batchTasks = getBatchTasks(state, count);
+      if (batchTasks.length === 0) {
+        const stats = buildGetStats(state);
+        return { content: [{ type: "text", text: JSON.stringify({
+          message: "No eligible pending tasks",
+          progress: stats
+        }, null, 2) }] };
+      }
+      return { content: [{ type: "text", text: JSON.stringify({
+        batch: batchTasks.map(formatBuildTask),
+        count: batchTasks.length,
+        instructions: [
+          "Implement all tasks in this batch",
+          "For each completed task, call action=done",
+          "Tasks are ordered by dependency \u2014 complete them in order",
+          "If stuck on one, call action=skip and continue with the next"
+        ]
+      }, null, 2) }] };
+    }
     default:
-      return { content: [{ type: "text", text: JSON.stringify({ error: `Unknown action: ${action}`, validActions: ["next", "current", "done", "skip", "status", "list", "init", "sync", "advance", "scan"] }, null, 2) }] };
+      return { content: [{ type: "text", text: JSON.stringify({ error: `Unknown action: ${action}`, validActions: ["next", "current", "done", "skip", "status", "list", "init", "sync", "advance", "scan", "handoff", "batch"] }, null, 2) }] };
   }
 }
 async function executeLocalSeed(args) {
@@ -53054,13 +53301,31 @@ var FALLBACK_TOOLS = [
   },
   {
     name: "bootspring_build",
-    description: "Autonomous build system. Get tasks, mark complete, check progress. Use action=next to get next task, action=done to mark complete, action=status for progress.",
+    description: `Autonomous build loop. Manages task queue with auto-commit and quality verification.
+
+Core loop: next -> implement -> done -> (auto-advances to next task)
+- action=done auto-commits with conventional message and returns next task
+- action=batch returns multiple tasks for efficient batch execution
+- action=handoff saves/loads session state for cross-session continuity
+- Dependencies are checked automatically \u2014 blocked tasks are skipped`,
     inputSchema: {
       type: "object",
       properties: {
-        action: { type: "string", enum: ["next", "current", "done", "skip", "status", "list", "init", "sync", "advance", "scan"] },
-        reason: { type: "string" },
-        autoDone: { type: "boolean" }
+        action: {
+          type: "string",
+          enum: ["next", "current", "done", "skip", "status", "list", "init", "sync", "advance", "scan", "handoff", "batch"],
+          description: "next: get next task | done: mark complete + auto-commit + return next | batch: get N tasks | handoff: save/load session state | advance: autonomous state machine"
+        },
+        reason: { type: "string", description: "Reason for skipping (action=skip)" },
+        autoDone: { type: "boolean", description: "Auto-complete if git is clean (action=advance)" },
+        autoCommit: { type: "boolean", description: "Auto-commit on done (default: true)" },
+        verify: { type: "boolean", description: "Run quality checks before done (default: true)" },
+        count: { type: "number", description: "Number of tasks to return (action=batch, max 10)" },
+        save: { type: "boolean", description: "Save handoff state (action=handoff)" },
+        notes: { type: "string", description: "Handoff notes for next session (action=handoff save)" },
+        filesModified: { type: "array", items: { type: "string" }, description: "Files modified this session (action=handoff save)" },
+        blockers: { type: "array", items: { type: "string" }, description: "Unresolved blockers (action=handoff save)" },
+        lastTaskId: { type: "string", description: "Last completed task ID (action=handoff save)" }
       },
       required: ["action"]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@girardmedia/bootspring",
-  "version": "2.7.0",
+  "version": "3.1.0",
   "description": "Thin client for Bootspring cloud MCP, hosted agents, and paywalled workflow intelligence",
   "keywords": [
     "ai",

package/scripts/postinstall.cjs

@@ -33,7 +33,13 @@ function resolveCommandsSource() {
 
 const COMMANDS_SOURCE = resolveCommandsSource();
 
-const BOOTSPRING_SKILL_CONTENT = `# Bootspring MCP Operating Skill
+const BOOTSPRING_SKILL_CONTENT = `---
+name: bootspring
+description: Bootspring MCP Operating Skill
+version: 1.0.0
+---
+
+# Bootspring MCP Operating Skill
 
 Use Bootspring MCP tools as the primary workflow for any project with Bootspring configured.
 These tools work via MCP protocol with any assistant: Claude Code, Codex, Gemini CLI, or others.