@happyvertical/smrt-cli 0.44.0 → 0.45.0

package/AGENTS.md

@@ -96,16 +96,34 @@ then `dist/smrt-knowledge.json`. Model tools come from the artifact's `mcp`
 surfaces (REST/CLI entries are not agent-addressable tools and are excluded);
 intents and playbooks come from its `agentSurface`.
 
-**Known under-report, tracked as #2619:** the artifact's `mcp` surfaces come
-from `configuredSurfaces()` in core, which returns nothing when an object omits
-`mcp` config — while `MCPGenerator` treats an omitted config as full CRUD and
-also emits eligible public custom-method tools. Doctor therefore lists fewer
-model tools than the runtime exposes for such an object. The error is
-conservative (it never advertises a tool that does not exist), and the fix
-belongs to the shared surface projection rather than this report.
+The artifact's `mcp` surfaces come from `configuredSurfaces()` in core, which
+derives the projection from the same defaults `MCPGenerator` applies rather
+than from the presence of an `mcp` config key (#2619): an omitted config is
+full CRUD, not a closed surface, and eligible public custom-method tools are
+included using the generator's own exhaustive-include rule.
 `renderAgentSurfaceReport(report)` returns the printed lines; both are exported
 so the shape is testable without running the command.
 
+**Known live over-exposure for an STI class with a bare `true`/omitted
+`mcp`/`cli` config, tracked as #2624:** the *scanner's* STI method merge in
+`manifest-generator.ts` walks the full inheritance chain unconditionally, so
+an STI class's `object.methods` already (incorrectly) contains its framework
+base classes' own internal methods (`save`, `toJSON`, `withTransaction`,
+`generateEmbeddings`, `destroy`, ...). This is not only a manifest
+artifact concern: `ObjectRegistry.getAllMethods()`'s runtime chain walk
+(`registry/inheritance-resolver.ts`) never actually filters it back out —
+its `SmrtObject`/`SmrtClass`/`SmrtCollection` ancestor-skip only fires for a
+chain entry literally named one of those three, and `getInheritanceChain()`
+already stops *before* adding such an ancestor to the chain, so that name
+never appears there to be skipped. The STI class itself is always the last
+chain entry, contributing its own (already-polluted) `methods` map
+unfiltered. So `CLIGenerator`/`MCPGenerator` genuinely register
+`<object>:save`, `<object>:withTransaction`, etc. as real, callable
+commands/tools **today, in a running application** — `configuredSurfaces()`
+here is reporting a real exposed surface, not fabricating one. #2624 tracks
+narrowing the scanner's STI method merge (or making the runtime skip
+actually reachable).
+
 Sample output:
 
 ```text

package/dist/index.js

@@ -3,7 +3,7 @@ import { readFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
-import { ObjectRegistry, getPackageFromQualifiedName } from "@happyvertical/smrt-core";
+import { ObjectRegistry, getPackageFromQualifiedName, isCrudOperation, isFrameworkBaseClass } from "@happyvertical/smrt-core";
 import { loadLocalTestManifestSync } from "@happyvertical/smrt-core/manifest";
 import { parseCliArgs } from "@happyvertical/utils";
 //#region src/discovery/manifest-identity.ts
@@ -575,6 +575,7 @@ var CLIGenerator = class {
 	async generateObjectCommands(objectName, _classInfo) {
 		const commands = [];
 		const lowerName = objectName.toLowerCase();
+		if (isFrameworkBaseClass(objectName, _classInfo?.packageName)) return commands;
 		const cliConfig = ObjectRegistry.getConfig(objectName).cli;
 		if (cliConfig === false) return commands;
 		const excluded = (typeof cliConfig === "object" ? cliConfig.exclude : []) || [];
@@ -706,16 +707,11 @@ var CLIGenerator = class {
 			}
 		});
 		const methods = await ObjectRegistry.getAllMethods(objectName);
-		const crudOperations = [
-			"list",
-			"get",
-			"create",
-			"update",
-			"delete"
-		];
-		const hasCustomMethodsInInclude = included?.some((item) => !crudOperations.includes(item));
+		const hasCustomMethodsInInclude = included?.some((item) => !isCrudOperation(item));
+		const reservedCommandNames = new Set(commands.flatMap((command) => [command.name, ...command.aliases ?? []]));
 		for (const [methodName, methodDef] of methods) {
 			const shouldIncludeMethod = () => {
+				if (reservedCommandNames.has(`${lowerName}:${methodName}`)) return false;
 				if (!methodDef.isPublic) return false;
 				if (excluded.includes(methodName)) return false;
 				if (hasCustomMethodsInInclude && included && !included.includes(methodName)) return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-cli",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "Developer CLI for SMRT framework - introspection, testing, and project management",
   "type": "module",
   "main": "./dist/index.js",
@@ -32,12 +32,12 @@
     "acorn": "^8.17.0",
     "fast-glob": "3.3.3",
     "tar": "^7.5.19",
-    "@happyvertical/smrt-agents": "0.44.0",
-    "@happyvertical/smrt-core": "0.44.0",
-    "@happyvertical/smrt-dev-mcp": "0.44.0",
-    "@happyvertical/smrt-config": "0.44.0",
-    "@happyvertical/smrt-types": "0.44.0",
-    "@happyvertical/smrt-playground": "0.44.0"
+    "@happyvertical/smrt-dev-mcp": "0.45.0",
+    "@happyvertical/smrt-config": "0.45.0",
+    "@happyvertical/smrt-core": "0.45.0",
+    "@happyvertical/smrt-playground": "0.45.0",
+    "@happyvertical/smrt-types": "0.45.0",
+    "@happyvertical/smrt-agents": "0.45.0"
   },
   "devDependencies": {
     "@types/node": "24.13.2",