@happyvertical/smrt-dev-mcp 0.47.0 → 0.47.1

package/AGENTS.md

@@ -23,6 +23,12 @@ deterministic SMRT ecosystem knowledge, and portable agent workflows.
 | `smrt-architecture` | Recommends SMRT/SDK packages, object-model sketch, risks, and questions |
 | `list-agent-skills` | Lists bundled harness-agnostic agent skills |
 | `get-agent-skill` | Returns a bundled agent skill as Markdown plus optional references |
+| `migration-status` | Live migration status from the `_smrt_schema_migrations` system table — completed/running/failed/rolled_back counts, latest completed and failed migrations (runtime provenance; read-only; optional live DB, #1824) |
+| `job-health` | Live job queue health from the `_smrt_jobs`/`_smrt_workers` system tables — counts by status, stuck/failed jobs, worker liveness; payloads/results never read (runtime provenance; read-only, #1824) |
+| `schedule-health` | Live agent schedule health from the `_smrt_agent_schedules` system table — due/overdue/errored counts, last/next run; sensitive `agentConfig` never read (runtime provenance; read-only, #1824) |
+| `dispatch-health` | Live dispatch health from the `_smrt_dispatch`/`_smrt_dispatch_subscriptions` system tables — stuck/pending by type/status, subscription topology; payloads/metadata never read (runtime provenance; read-only, #1824) |
+| `recent-changes` | Tail of the `_smrt_changes` append-only change feed with cursor semantics, filterable by table and tenant (runtime provenance; read-only, #1824) |
+| `registry-drift` | Registry drift report — `_smrt_registry` is retired and reported as such, never queried or fabricated (read-only, #1824) |
 
 `pnpm knowledge:check --strict --format markdown` compares this catalog and the
 README parameter tables to the exported `TOOLS` definitions. Add or change a

package/README.md

@@ -456,6 +456,119 @@ Return a bundled agent skill as Markdown, with optional referenced files.
 | `name` | `'smrt-code-review'` | Yes | Skill name |
 | `includeReferences` | `boolean` | No | Include referenced files (default: true) |
 
+### `migration-status`
+
+Live migration status from the `_smrt_schema_migrations` system table:
+completed / running / failed / rolled-back counts (the tracker's real status
+vocabulary) plus the latest completed and the failed migrations. Runtime
+provenance (`runtime (live DB)`); read-only. Without a configured connection it
+returns a successful static-only result.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `dbUrl` | `string` | No | Optional dev database URL override (read-only diagnostics); prefer `SMRT_DEV_DB_URL` or `cli.database` config |
+| `dbType` | `'sqlite' \| 'postgres' \| 'duckdb'` | No | Optional engine hint for `dbUrl` or the environment connection; inferred from the URL scheme when omitted |
+| `limit` | `number` | No | Row budget for result lists (default 50, capped at 500) |
+
+### `job-health`
+
+Live job queue health from the `_smrt_jobs`, `_smrt_workers`, and
+`_smrt_job_events` system tables: counts by status, stuck/failed jobs, worker
+liveness. Job payloads and results are never read. Runtime provenance;
+read-only.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `dbUrl` | `string` | No | Optional dev database URL override (read-only diagnostics); prefer `SMRT_DEV_DB_URL` or `cli.database` config |
+| `dbType` | `'sqlite' \| 'postgres' \| 'duckdb'` | No | Optional engine hint for `dbUrl` or the environment connection; inferred from the URL scheme when omitted |
+| `limit` | `number` | No | Row budget for result lists (default 50, capped at 500) |
+
+### `schedule-health`
+
+Live agent schedule health from the `_smrt_agent_schedules` system table:
+due/overdue/errored counts, last/next run per schedule. The sensitive
+`agentConfig`/`methodArgs` columns are never read. Runtime provenance;
+read-only.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `dbUrl` | `string` | No | Optional dev database URL override (read-only diagnostics); prefer `SMRT_DEV_DB_URL` or `cli.database` config |
+| `dbType` | `'sqlite' \| 'postgres' \| 'duckdb'` | No | Optional engine hint for `dbUrl` or the environment connection; inferred from the URL scheme when omitted |
+| `limit` | `number` | No | Row budget for result lists (default 50, capped at 500) |
+
+### `dispatch-health`
+
+Live dispatch health from the `_smrt_dispatch` and
+`_smrt_dispatch_subscriptions` system tables: stuck/pending messages by type
+and status plus subscription topology. Dispatch payloads and metadata are never
+read. Runtime provenance; read-only.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `dbUrl` | `string` | No | Optional dev database URL override (read-only diagnostics); prefer `SMRT_DEV_DB_URL` or `cli.database` config |
+| `dbType` | `'sqlite' \| 'postgres' \| 'duckdb'` | No | Optional engine hint for `dbUrl` or the environment connection; inferred from the URL scheme when omitted |
+| `limit` | `number` | No | Row budget for result lists (default 50, capped at 500) |
+
+### `recent-changes`
+
+Tail of the `_smrt_changes` append-only change feed with cursor semantics,
+filterable by table and tenant. Runtime provenance; read-only.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `dbUrl` | `string` | No | Optional dev database URL override (read-only diagnostics); prefer `SMRT_DEV_DB_URL` or `cli.database` config |
+| `dbType` | `'sqlite' \| 'postgres' \| 'duckdb'` | No | Optional engine hint for `dbUrl` or the environment connection; inferred from the URL scheme when omitted |
+| `since` | `number` | No | Cursor to read after (default 0) |
+| `tables` | `string[]` | No | Restrict to these physical table names |
+| `tenantId` | `string` | No | Tenant narrowing filter |
+| `limit` | `number` | No | Page size (default 200, capped at 500) |
+
+### `registry-drift`
+
+Registry drift report. `_smrt_registry` is retired (system schema 1.10.1) and
+is never queried: the tool reports the retirement and whether a legacy empty
+table remains, and never fabricates drift. Declared objects come from the
+static manifest tools. Read-only.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `dbUrl` | `string` | No | Optional dev database URL override (read-only diagnostics); prefer `SMRT_DEV_DB_URL` or `cli.database` config |
+| `dbType` | `'sqlite' \| 'postgres' \| 'duckdb'` | No | Optional engine hint for `dbUrl` or the environment connection; inferred from the URL scheme when omitted |
+
+## Runtime Diagnostics (Optional Live DB)
+
+The six runtime-diagnostics tools above (`migration-status`, `job-health`,
+`schedule-health`, `dispatch-health`, `recent-changes`, `registry-drift`) share
+an **optional, read-only** dev-database connection so a development agent can
+see runtime truth — not just what static artifacts declare. They complement the
+static knowledge tools (#1819); together the two surfaces give the full
+picture.
+
+**Configuration.** Connection resolution, per call: an explicit `dbUrl`
+argument, then the `SMRT_DEV_DB_URL` environment variable, then the project's
+smrt config `cli.database` (`database.type` / `database.url`). An optional
+`dbType` argument (`sqlite`, `postgres`, `duckdb`) overrides engine inference
+for `dbUrl` or the environment connection; unknown values fail with a safe
+diagnostic instead of opening the wrong adapter. No configuration
+anywhere → every runtime tool returns a successful static-only result
+(`provenance: 'static'`, `connected: false`) and the server starts and serves
+all static tools unaffected.
+
+**Provenance labeling.** Live results carry `provenance: 'runtime (live DB)'`;
+static-only results carry `provenance: 'static'`. Never conflate the two: the
+manifest reports what the code declares, runtime tools report what the running
+system is doing.
+
+**Read-only, dev-only.** Every runtime statement is a bounded `SELECT` with an
+explicit safe column projection. Sensitive columns (job payloads/results,
+schedule `agentConfig`/`methodArgs`, dispatch `payload`/`metadata`) are never
+selected. This is a dev/localhost diagnostic surface, not a data plane — it is
+not `smrt-app-mcp` and never writes.
+
+**Connection strings are never logged.** Surfaced URLs are redacted
+(passwords and token query params masked); driver errors pass through a
+redacting normalizer before they can appear in a diagnostic.
+
 ## MCP Resources And Prompts
 
 Resources:

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAGL,MAAM,EACP,MAAM,8BAA8B,CAAC;AAsBtC,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAG1C,eAAO,MAAM,cAAc,QAAuB,CAAC;AA6BnD,wBAAgB,YAAY,IAAI,MAAM,CAgnBrC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAGL,MAAM,EACP,MAAM,8BAA8B,CAAC;AA+BtC,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAG1C,eAAO,MAAM,cAAc,QAAuB,CAAC;AA6BnD,wBAAgB,YAAY,IAAI,MAAM,CA4qBrC"}

package/dist/index.js

@@ -1,13 +1,17 @@
 #!/usr/bin/env node
-import { a as checkKnowledgeFreshness, f as smrtArchitecture, h as TOOLS, i as buildReviewContext, m as REVIEW_SKILL_NAME, n as buildKnowledgeIndex, o as checkKnowledgeFreshnessFromIndex, p as smrtReview, r as buildPackageSpecialistContext, s as compactContextResult, t as buildArchitectureContext } from "./knowledge-SqpqYA67.js";
+import { a as checkKnowledgeFreshness, f as smrtArchitecture, h as TOOLS, i as buildReviewContext, m as REVIEW_SKILL_NAME, n as buildKnowledgeIndex, o as checkKnowledgeFreshnessFromIndex, p as smrtReview, r as buildPackageSpecialistContext, s as compactContextResult, t as buildArchitectureContext } from "./knowledge-DmZ-7GO9.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { ProtocolError, ProtocolErrorCode, Server } from "@modelcontextprotocol/server";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
+import { createHash } from "node:crypto";
 import { ManifestAdapter, OxcScanner } from "@happyvertical/smrt-scanner";
 import { access, readFile, readdir } from "node:fs/promises";
 import { ManifestGenerator } from "@happyvertical/smrt-core/scanner";
+import { readDispatchHealth, readJobHealth, readMigrationStatus, readRecentChanges, readRegistryDrift, readScheduleHealth } from "@happyvertical/smrt-core";
+import { getPackageConfig, loadConfig } from "@happyvertical/smrt-config";
+import { getDatabase } from "@happyvertical/sql";
 //#region src/agent-skills.ts
 var AGENT_SKILLS = [{
 	name: "smrt-code-review",
@@ -1052,6 +1056,395 @@ function pathExistsSyncHint(path) {
 	return existsSync(path);
 }
 //#endregion
+//#region src/tools/runtime/connection.ts
+/**
+* Optional read-only dev-database connection resolution for runtime
+* diagnostics tools (#1824).
+*
+* Resolution order per call:
+*   1. explicit `dbUrl`/`dbType` tool arguments
+*   2. `SMRT_DEV_DB_URL` environment variable
+*   3. the project's cosmiconfig CLI section (`getPackageConfig('cli', ...)`
+*      from `@happyvertical/smrt-config`) → `database.{type,url}`
+*
+* No configured connection → `db: null` with `source: 'none'`; callers return
+* a successful static-only envelope. A connection is always opened lazily per
+* call and closed in the caller's `finally` — nothing is cached across calls
+* and the server never holds a database handle.
+*
+* Sensitive handling: connection strings are never logged or echoed. Every
+* surfaced URL passes through {@link redactConnectionString}; driver errors
+* are surfaced only through {@link safeErrorMessage}, which strips anything
+* that looks like a credential-bearing URL.
+*/
+var RUNTIME_DATABASE_TYPES = [
+	"sqlite",
+	"postgres",
+	"duckdb"
+];
+function isRuntimeDatabaseType(value) {
+	return RUNTIME_DATABASE_TYPES.includes(value);
+}
+/**
+* Sensitive query-parameter names. Matching normalizes the key (lowercase,
+* `_`/`-` stripped), so camelCase (`authToken`, `accessToken`) and hyphen
+* variants (`api-key`) are masked exactly like their snake_case forms.
+*/
+var SENSITIVE_QUERY_PARAMS = [
+	"access_token",
+	"apikey",
+	"api_key",
+	"auth",
+	"auth_token",
+	"connectionstring",
+	"connection_string",
+	"password",
+	"token"
+];
+function normalizeQueryParamName(key) {
+	return key.toLowerCase().replace(/[_-]/g, "");
+}
+var SENSITIVE_QUERY_PARAM_NAMES = new Set(SENSITIVE_QUERY_PARAMS.map(normalizeQueryParamName));
+var DEFAULT_CLI_DATABASE = { database: {
+	type: "sqlite",
+	url: ":memory:"
+} };
+/**
+* Redact a connection string so it can be shown to an agent without leaking
+* credentials. Mirrors the CLI's `redactConnectionString` (which is CLI
+* private); patterned identically so dev-mcp never depends on the CLI.
+*
+* Query-parameter masking normalizes each key (lowercase, `_`/`-` stripped),
+* so camelCase forms such as Turso/libsql's `?authToken=` mask exactly like
+* their snake_case forms. A final regex pass also masks `key=value` pairs
+* embedded in free text (driver error messages often quote the URL); it treats
+* the start of the string, `?`, `&`, `,`, `(`, and whitespace as the
+* preceding boundary.
+*/
+function redactConnectionString(value) {
+	let redacted = value;
+	try {
+		const url = new URL(value);
+		if (url.password) url.password = "***";
+		for (const key of [...url.searchParams.keys()]) if (SENSITIVE_QUERY_PARAM_NAMES.has(normalizeQueryParamName(key))) url.searchParams.set(key, "***");
+		redacted = url.toString();
+	} catch {
+		redacted = value.replace(/([a-z][a-z0-9+.-]*:\/\/[^:\s/@]+:)(?:[^@\s]|@(?=[^@\s]*@))+(@)/gi, "$1***$2");
+	}
+	return redacted.replace(/((?:^|[?&,(\s])([a-z][a-z0-9_-]{0,30})=)([^&,\s)]+)/gi, (match, prefix, key) => SENSITIVE_QUERY_PARAM_NAMES.has(normalizeQueryParamName(key)) ? `${prefix}***` : match);
+}
+/**
+* Build a safe, redacted error message for a database failure. Connection
+* strings and raw driver error objects are never surfaced verbatim.
+*/
+function safeErrorMessage(error) {
+	return redactConnectionString(error instanceof Error ? error.message : String(error ?? "unknown error"));
+}
+/**
+* Normalize a type hint into an engine `getDatabase` accepts. Unknown values
+* throw a safe error (no URL is included) so the caller can surface a
+* diagnostic instead of silently opening the wrong adapter.
+*/
+function toRuntimeDatabaseType(value) {
+	const normalized = value.trim().toLowerCase();
+	if (isRuntimeDatabaseType(normalized)) return normalized;
+	throw new Error(`Unsupported runtime database type "${normalized}"; expected sqlite, postgres, or duckdb`);
+}
+/** Infer an engine hint from a URL scheme when no explicit type is given. */
+function inferDatabaseType(url, hint) {
+	if (hint && hint.trim().length > 0) return hint;
+	if (/^postgres(ql)?:/i.test(url)) return "postgres";
+	if (/^duckdb:/i.test(url)) return "duckdb";
+	return "sqlite";
+}
+/**
+* Resolve the dev-database connection for one tool call.
+*
+* Returns `db: null` (never throws) when no connection is configured; callers
+* must treat that as "no runtime database" and return a static-only envelope.
+* A thrown connect error is propagated to the caller, which converts it into
+* a diagnostic envelope — it must never reach the MCP transport.
+*/
+async function resolveRuntimeConnection(args = {}) {
+	const argUrl = args.dbUrl?.trim();
+	if (argUrl && argUrl !== ":memory:") {
+		const databaseType = toRuntimeDatabaseType(inferDatabaseType(argUrl, args.dbType));
+		return {
+			db: await getDatabaseInstance({
+				type: databaseType,
+				url: argUrl
+			}),
+			source: "argument",
+			displayUrl: redactConnectionString(argUrl),
+			databaseType
+		};
+	}
+	const envUrl = process.env.SMRT_DEV_DB_URL?.trim();
+	if (envUrl && envUrl !== ":memory:") {
+		const databaseType = toRuntimeDatabaseType(inferDatabaseType(envUrl, args.dbType));
+		return {
+			db: await getDatabaseInstance({
+				type: databaseType,
+				url: envUrl
+			}),
+			source: "environment",
+			displayUrl: redactConnectionString(envUrl),
+			databaseType
+		};
+	}
+	const config = await loadCliDatabaseConfig();
+	const configUrl = config?.database?.url?.trim();
+	if (configUrl && configUrl !== ":memory:") {
+		const databaseType = toRuntimeDatabaseType(config.database?.type || inferDatabaseType(configUrl, args.dbType));
+		return {
+			db: await getDatabaseInstance({
+				type: databaseType,
+				url: configUrl
+			}),
+			source: "config",
+			displayUrl: redactConnectionString(configUrl),
+			databaseType
+		};
+	}
+	return {
+		db: null,
+		source: "none",
+		displayUrl: "",
+		databaseType: null
+	};
+}
+async function loadCliDatabaseConfig() {
+	try {
+		await loadConfig();
+		const database = getPackageConfig("cli", DEFAULT_CLI_DATABASE).database;
+		if (database && typeof database.url === "string") return { database };
+		return {};
+	} catch {
+		return {};
+	}
+}
+async function getDatabaseInstance(options) {
+	return getDatabase(options);
+}
+/**
+* Best-effort close of a resolved connection. Never throws; diagnostics must
+* not fail because cleanup hiccuped.
+*/
+async function closeRuntimeConnection(db) {
+	if (!db || typeof db !== "object") return;
+	const closeable = db;
+	const close = closeable.close ?? closeable.client?.end ?? closeable.client?.close;
+	if (typeof close !== "function") return;
+	try {
+		await close.call(closeable.close ? closeable : closeable.client);
+	} catch {}
+}
+//#endregion
+//#region src/tools/runtime/tools.ts
+/**
+* Runtime diagnostics tools (#1824): read-only views over a project's dev
+* database `_smrt_*` system tables, powered by the shared SELECT-only
+* system-diagnostics reader in `@happyvertical/smrt-core`.
+*
+* Contract:
+* - **Optional connection.** No configured connection returns a successful
+*   static-only envelope — the server always starts and static tools are
+*   unaffected. A live connection is opened lazily per call and closed in
+*   `finally`; nothing is cached across calls.
+* - **Read-only.** Every underlying statement is a bounded SELECT; the reader
+*   never selects sensitive columns (job payloads/results, schedule
+*   `agentConfig`/`methodArgs`, dispatch `payload`/`metadata`).
+* - **Provenance-labeled.** Live results carry `provenance: 'runtime (live DB)'`;
+*   static-only results carry `provenance: 'static'` — agents must never
+*   conflate runtime facts with declared/manifest facts.
+* - **Fail-safe.** A connect/read error becomes a diagnostic envelope; it must
+*   never reach the MCP transport and never includes raw driver text or URLs.
+*/
+/** Provenance labels separating runtime facts from static/declared facts. */
+var RUNTIME_PROVENANCE = "runtime (live DB)";
+var STATIC_PROVENANCE = "static";
+/**
+* Serialize resolve → read → close per connection target so overlapping tool
+* calls never close a shared cached handle out from under each other.
+*
+* `@happyvertical/sql`'s `getDatabase` returns a cached handle per URL (no
+* opt-out in its public API). `closeRuntimeConnection` only calls the handle's
+* own `close`/`end`, but the SDK wraps those so a close also evicts the handle
+* from its connection cache. Two concurrent diagnostics calls resolving the
+* same URL would therefore share one handle, with the first finisher closing
+* it mid-read for the second. A per-key promise chain keeps each call's
+* lifecycle private: every call resolves its own view of the connection,
+* performs its read, and only then closes — the next queued call re-resolves
+* a fresh handle.
+*
+* The key is a digest of the resolved target, never the raw URL, so a
+* credential-bearing connection string is not retained in this map.
+*/
+var runtimeReadQueues = /* @__PURE__ */ new Map();
+function connectionQueueKey(args) {
+	const target = args.dbUrl?.trim() || process.env.SMRT_DEV_DB_URL?.trim() || "cli.config";
+	return createHash("sha256").update(target).digest("hex");
+}
+async function enqueueRuntimeRead(key, operation) {
+	const run = (runtimeReadQueues.get(key) ?? Promise.resolve()).then(operation, operation);
+	const tail = run.catch(() => void 0);
+	runtimeReadQueues.set(key, tail);
+	tail.then(() => {
+		if (runtimeReadQueues.get(key) === tail) runtimeReadQueues.delete(key);
+	});
+	return run;
+}
+/**
+* Run one read against the optional runtime connection, mapping every outcome
+* to a successful MCP envelope:
+*
+* - no connection configured → static-only envelope (`connected: false`)
+* - connect failure → static envelope with a safe diagnostic
+* - read failure → connected envelope with a safe diagnostic
+* - success → live result under `provenance: 'runtime (live DB)'`; a
+*   category-unavailable reader result keeps its `available: false` data and
+*   surfaces its message as a diagnostic
+*/
+async function withRuntimeConnection(args, read, staticHint) {
+	return enqueueRuntimeRead(connectionQueueKey(args), () => runWithRuntimeConnection(args, read, staticHint));
+}
+async function runWithRuntimeConnection(args, read, staticHint) {
+	let resolved;
+	try {
+		resolved = await resolveRuntimeConnection(args);
+	} catch (error) {
+		return {
+			ok: true,
+			coverage: null,
+			diagnostics: [{
+				severity: "warning",
+				code: "runtime_connection_error",
+				message: safeErrorMessage(error)
+			}],
+			data: {
+				provenance: STATIC_PROVENANCE,
+				connected: false
+			}
+		};
+	}
+	if (!resolved.db) return {
+		ok: true,
+		coverage: null,
+		diagnostics: [{
+			severity: "info",
+			code: "runtime_connection_unavailable",
+			message: `No runtime dev database configured (set SMRT_DEV_DB_URL or cli.database); returning static-only result: ${staticHint}. Static tools are unaffected.`
+		}],
+		data: {
+			provenance: STATIC_PROVENANCE,
+			connected: false
+		}
+	};
+	const { db, source, displayUrl, databaseType } = resolved;
+	try {
+		const { data, diagnostics } = await read(db);
+		return {
+			ok: true,
+			coverage: null,
+			diagnostics,
+			data: {
+				provenance: RUNTIME_PROVENANCE,
+				connected: true,
+				connectionSource: source,
+				databaseType,
+				displayUrl,
+				...data
+			}
+		};
+	} catch (error) {
+		return {
+			ok: true,
+			coverage: null,
+			diagnostics: [{
+				severity: "warning",
+				code: "runtime_read_error",
+				message: safeErrorMessage(error)
+			}],
+			data: {
+				provenance: RUNTIME_PROVENANCE,
+				connected: true,
+				connectionSource: source,
+				databaseType,
+				displayUrl
+			}
+		};
+	} finally {
+		await closeRuntimeConnection(db);
+	}
+}
+/**
+* Stored error columns (`error_message`, `last_error`) are free text written
+* at failure time and routinely quote connection URLs or credentials. Every
+* string in a live result passes through {@link redactConnectionString}
+* before it reaches an MCP client; structure and non-string values are kept.
+*/
+function redactStrings(value) {
+	if (typeof value === "string") return redactConnectionString(value);
+	if (Array.isArray(value)) return value.map((item) => redactStrings(item));
+	if (value !== null && typeof value === "object") {
+		const out = {};
+		for (const [key, item] of Object.entries(value)) out[key] = redactStrings(item);
+		return out;
+	}
+	return value;
+}
+/** Convert a reader result into envelope data + diagnostics. */
+function toEnvelopeParts(rawResult) {
+	const result = redactStrings(rawResult);
+	if (result !== null && typeof result === "object" && "available" in result && result.available === false) {
+		const unavailable = result;
+		const { message, ...rest } = unavailable;
+		return {
+			data: rest,
+			diagnostics: [{
+				severity: unavailable.reason === "retired" ? "info" : "warning",
+				code: `category_unavailable_${String(unavailable.reason).replace(/-/g, "_")}`,
+				message: String(message)
+			}]
+		};
+	}
+	return {
+		data: result,
+		diagnostics: []
+	};
+}
+function readToParts(read) {
+	return read.then((result) => toEnvelopeParts(result));
+}
+async function runtimeMigrationStatus(args = {}) {
+	const { limit, ...connectionArgs } = args;
+	return withRuntimeConnection(connectionArgs, (db) => readToParts(readMigrationStatus(db, { limit })), "no migration status — the manifest still reports the declared schema");
+}
+async function runtimeJobHealth(args = {}) {
+	const { limit, ...connectionArgs } = args;
+	return withRuntimeConnection(connectionArgs, (db) => readToParts(readJobHealth(db, { limit })), "no job health snapshot — the manifest still reports declared job queues");
+}
+async function runtimeScheduleHealth(args = {}) {
+	const { limit, ...connectionArgs } = args;
+	return withRuntimeConnection(connectionArgs, (db) => readToParts(readScheduleHealth(db, { limit })), "no schedule health snapshot — the manifest still reports declared schedules");
+}
+async function runtimeDispatchHealth(args = {}) {
+	const { limit, ...connectionArgs } = args;
+	return withRuntimeConnection(connectionArgs, (db) => readToParts(readDispatchHealth(db, { limit })), "no dispatch health snapshot — the manifest still reports declared dispatch topology");
+}
+async function runtimeRecentChanges(args = {}) {
+	const { since, tables, tenantId, limit, ...connectionArgs } = args;
+	return withRuntimeConnection(connectionArgs, (db) => readToParts(readRecentChanges(db, {
+		since,
+		tables,
+		tenantId,
+		limit
+	})), "no recent changes — static knowledge artifacts are unchanged");
+}
+async function runtimeRegistryDrift(args = {}) {
+	return withRuntimeConnection(args, (db) => readToParts(readRegistryDrift(db)), "no registry drift report — _smrt_registry is retired; declared objects come from the manifest");
+}
+//#endregion
 //#region src/index.ts
 /**
 * SMRT Development MCP Server
@@ -1329,7 +1722,7 @@ function createServer() {
 		const { name, arguments: args } = request.params;
 		if (DEBUG) {
 			console.error(`[${SERVER_NAME}] CallTool: ${name}`);
-			console.error(`[${SERVER_NAME}] Arguments:`, JSON.stringify(args, null, 2));
+			console.error(`[${SERVER_NAME}] Arguments:`, JSON.stringify(redactDebugArguments(args), null, 2));
 		}
 		try {
 			let result;
@@ -1404,6 +1797,24 @@ function createServer() {
 				case "get-agent-skill":
 					result = JSON.stringify(await getAgentSkill(args), null, 2);
 					break;
+				case "migration-status":
+					result = JSON.stringify(await runtimeMigrationStatus(args), null, 2);
+					break;
+				case "job-health":
+					result = JSON.stringify(await runtimeJobHealth(args), null, 2);
+					break;
+				case "schedule-health":
+					result = JSON.stringify(await runtimeScheduleHealth(args), null, 2);
+					break;
+				case "dispatch-health":
+					result = JSON.stringify(await runtimeDispatchHealth(args), null, 2);
+					break;
+				case "recent-changes":
+					result = JSON.stringify(await runtimeRecentChanges(args), null, 2);
+					break;
+				case "registry-drift":
+					result = JSON.stringify(await runtimeRegistryDrift(args), null, 2);
+					break;
 				default: throw new Error(`Unknown tool: ${name}`);
 			}
 			return {
@@ -1522,11 +1933,26 @@ function detailArg(args) {
 	const detail = args?.detail;
 	return typeof detail === "string" ? detail : void 0;
 }
+/**
+* Debug logging happens before any tool runs its own redaction, so a
+* credential-bearing `dbUrl` argument must be masked here.
+*/
+function redactDebugArguments(args) {
+	if (!isRecord(args) || typeof args.dbUrl !== "string") return args;
+	return {
+		...args,
+		dbUrl: redactConnectionString(args.dbUrl)
+	};
+}
+function isRuntimeEnvelope(value) {
+	return isRecord(value) && typeof value.ok === "boolean" && "coverage" in value && Array.isArray(value.diagnostics) && "data" in value;
+}
 function toDevToolStructuredContent(result) {
 	let data = result;
 	try {
 		data = JSON.parse(result);
 	} catch {}
+	if (isRuntimeEnvelope(data)) return data;
 	const source = isRecord(data) ? data : void 0;
 	return {
 		ok: true,