@lyric_dev/data-loom 0.5.0 → 0.7.0

package/dist/index.js

@@ -12,10 +12,15 @@ import { discover } from "./mcp/discovery.js";
 import { checkServer } from "./mcp/availability.js";
 import { discoverProjects, isViewableProject } from "./projects.js";
 import { resolvePublicDir } from "./assets.js";
-import { HOST, PORT } from "./paths.js";
+import { HOST, PORT, baseUrl } from "./paths.js";
 import * as lifecycle from "./lifecycle.js";
 import * as autostart from "./autostart.js";
 import * as claudeDesktop from "./claudeDesktop.js";
+import * as claudeCode from "./claudeCode.js";
+import { runShim } from "./mcpShim.js";
+import { refreshWeaveAliasIfOutdated } from "./weaveAlias.js";
+import { VERSION } from "./version.js";
+import { initTray } from "./tray.js";
 const host = HOST;
 const port = PORT;
 // Initial project: CLI argument, then DATA_LOOM_ROOT, then cwd.
@@ -33,6 +38,14 @@ async function main() {
             "data_loom does not bundle it — install it separately, e.g. `npm i -g openspec`, then retry.");
         process.exit(1);
     }
+    // Heal an existing `/loom:weave` alias left by an older version (or a
+    // pre-stamp install) — never creates the file when the user hasn't opted in.
+    try {
+        await refreshWeaveAliasIfOutdated(VERSION);
+    }
+    catch (err) {
+        console.warn(`[data-loom] could not refresh the /loom:weave command (continuing): ${err instanceof Error ? err.message : err}`);
+    }
     // Resolve a viewable project: the launch dir, else the first discovered one,
     // else none. Never exit just because the launch dir isn't a project.
     let active = isViewableProject(initialProject) ? initialProject : null;
@@ -46,28 +59,70 @@ async function main() {
     else {
         console.log("[data-loom] no openspec project found at launch — open the dashboard and pick one");
     }
-    server = await startServer({
-        publicDir: resolvePublicDir(),
-        host,
-        port,
-        getRoadmap: () => session?.model ?? null,
-        getMcp,
-        checkMcp,
-        getProjects,
-        selectProject,
-        getCurrentProject: () => session?.project ?? null,
-    });
-    console.log(`[data-loom] dashboard ready at http://${host}:${server.port}`);
+    // Forward reference so the loopback /api/shutdown route can invoke the same
+    // graceful shutdown() defined below (it's declared after startServer).
+    let shutdownRef = () => process.exit(0);
+    try {
+        server = await startServer({
+            publicDir: resolvePublicDir(),
+            host,
+            port,
+            getRoadmap: () => session?.model ?? null,
+            getMcp,
+            checkMcp,
+            getProjects,
+            selectProject,
+            getCurrentProject: () => session?.project ?? null,
+            onShutdown: () => shutdownRef(),
+        });
+    }
+    catch (err) {
+        if (err.code === "EADDRINUSE") {
+            // A DataLoom daemon is already on this port (e.g. the background one).
+            // That's fine — point at the running instance instead of crashing.
+            console.log(`[data-loom] already running at http://${host}:${port} — using that instance.`);
+            openBrowser(`http://${host}:${port}`);
+            session?.stopWatch(); // release the watcher started for this aborted launch
+            return;
+        }
+        throw err;
+    }
+    const url = `http://${host}:${server.port}`;
+    console.log(`[data-loom] dashboard ready at ${url}`);
     if (session)
         console.log(`[data-loom] project: ${session.project}`);
-    openBrowser(`http://${host}:${server.port}`);
+    openBrowser(url);
+    // When launched supervised (an OS login supervisor execs this directly, in
+    // the foreground, with DATA_LOOM_DETACHED=1), there is no parent `start`
+    // spawn to record our PID — write it ourselves so `status`/`stop` work the
+    // same as when `start` launched us detached.
+    if (process.env.DATA_LOOM_DETACHED) {
+        await lifecycle.writeSelfPid().catch(() => { });
+    }
+    // Tray icon: an ambient "DataLoom is running" indicator (essential in the
+    // detached mode, which has no console). Guarded no-op where unavailable.
+    let tray = { dispose: () => { } };
+    // Every deliberate shutdown path below (SIGINT, SIGTERM, tray Stop) funnels
+    // through here and exits 0. OS supervisors (Scheduled Task restart-on-
+    // failure, launchd KeepAlive, systemd Restart=on-failure) treat a clean
+    // exit 0 as "stopped on purpose" and do NOT restart it — only a crash or
+    // non-zero exit does. Do not change a deliberate stop to any other exit code.
     const shutdown = () => {
+        tray.dispose();
         session?.stopWatch();
         server?.close();
         process.exit(0);
     };
+    shutdownRef = shutdown; // route the loopback /api/shutdown POST here too
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
+    tray = initTray({
+        url,
+        onOpen: () => launchBrowser(url),
+        onCopy: () => copyToClipboard(url),
+        onStop: shutdown,
+        log: (msg) => console.error(msg),
+    });
 }
 async function buildSession(project) {
     const client = new OpenSpecClient(project);
@@ -132,6 +187,10 @@ function openBrowser(url) {
     // terminal, so never pop a browser for them (nor when explicitly suppressed).
     if (process.env.DATA_LOOM_NO_OPEN || process.env.DATA_LOOM_DETACHED)
         return;
+    launchBrowser(url);
+}
+/** Open a URL in the default browser unconditionally (used by the tray). */
+function launchBrowser(url) {
     try {
         if (process.platform === "win32") {
             spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", detached: true }).unref();
@@ -147,20 +206,68 @@ function openBrowser(url) {
         /* non-fatal — the URL is already logged */
     }
 }
+/** Best-effort copy of text to the system clipboard; failure is silent. */
+function copyToClipboard(text) {
+    try {
+        const proc = process.platform === "win32"
+            ? spawn("clip")
+            : process.platform === "darwin"
+                ? spawn("pbcopy")
+                : spawn("xclip", ["-selection", "clipboard"]);
+        proc.on("error", () => { });
+        proc.stdin?.end(text);
+    }
+    catch {
+        /* no clipboard tool available — non-fatal */
+    }
+}
 // ---- CLI verb dispatch -----------------------------------------------------
 // A leading reserved verb selects a lifecycle/autostart/integration command;
 // anything else falls through to the foreground daemon (with argv[2] as the
 // optional project path), preserving the original invocation unchanged.
-const VERBS = new Set(["start", "stop", "restart", "status", "autostart", "connect", "disconnect"]);
+const VERBS = new Set([
+    "up",
+    "start",
+    "stop",
+    "restart",
+    "status",
+    "autostart",
+    "connect",
+    "disconnect",
+    "update",
+    "mcp-shim",
+]);
 async function runAutostart(rest) {
     const sub = rest[0];
     if (sub === "enable") {
-        await autostart.enable();
-        console.log("[data-loom] autostart enabled (launches on login)");
-        // Enabling also brings the daemon up now, so it's running this session too —
-        // opt out with --no-start.
-        if (!rest.includes("--no-start"))
+        const info = await autostart.enable();
+        console.log(`[data-loom] autostart enabled (${info.mechanism})` +
+            (info.supervised
+                ? " — the daemon restarts automatically if it crashes"
+                : " — supervision is not available on this host; the daemon will not auto-restart on crash"));
+        // Enabling also brings the daemon up now, so it's running this session too.
+        // A supervised start-on-register mechanism (systemd `enable --now`, launchd
+        // `RunAtLoad`) already launched it — starting again would spawn a second
+        // detached instance that races the supervised one for the port, so only
+        // start it ourselves when registration didn't. Opt out with --no-start.
+        if (info.startedNow) {
+            console.log(`[data-loom] the daemon is running now — ${baseUrl()}`);
+        }
+        else if (!rest.includes("--no-start")) {
             await lifecycle.start();
+        }
+        // ...and points Claude Code at it, so the always-on path both hosts and
+        // registers the MCP endpoint. Best-effort: a missing `claude` CLI must not
+        // fail the enable (the login item + daemon already succeeded). Opt out with
+        // --no-connect.
+        if (!rest.includes("--no-connect")) {
+            try {
+                await claudeCode.connect();
+            }
+            catch (err) {
+                console.warn(`[data-loom] could not register with Claude Code (continuing): ${err instanceof Error ? err.message : err}`);
+            }
+        }
         return;
     }
     if (sub === "disable") {
@@ -174,27 +281,140 @@ async function runAutostart(rest) {
             : "[data-loom] autostart is not enabled");
         return;
     }
-    throw new Error("usage: data-loom autostart <enable|disable|status> [--no-start]");
+    throw new Error("usage: data-loom autostart <enable|disable|status> [--no-start] [--no-connect]");
 }
 async function runConnect(rest) {
-    if (rest[0] !== "claude-desktop")
-        throw new Error("usage: data-loom connect claude-desktop [--bridge]");
-    const bridge = rest.includes("--bridge");
-    const path = await claudeDesktop.connect({ bridge });
-    console.log(`[data-loom] registered DataLoom in Claude Desktop (${bridge ? "stdio bridge" : "native HTTP"}) — ${path}`);
-    console.log("[data-loom] restart Claude Desktop to pick it up; DataLoom must be running to serve the tools.");
+    const target = rest[0];
+    if (target === "claude-code") {
+        const onDemand = rest.includes("--on-demand");
+        const { registered, switchedFrom } = await claudeCode.connect({ onDemand });
+        if (registered) {
+            if (switchedFrom) {
+                console.log(`[data-loom] switched Claude Code registration from ${switchedFrom === "stdio" ? "on-demand stdio" : "native HTTP"} to ${onDemand ? "on-demand stdio" : "native HTTP"}`);
+            }
+            console.log(onDemand
+                ? "[data-loom] registered DataLoom in Claude Code (user scope, on-demand stdio shim)"
+                : "[data-loom] registered DataLoom in Claude Code (user scope, native HTTP)");
+            console.log(onDemand
+                ? "[data-loom] start a new Claude Code session (or /mcp reconnect) to pick it up; the shim starts DataLoom automatically when needed."
+                : "[data-loom] start a new Claude Code session (or /mcp reconnect) to pick it up; DataLoom must be running to serve the tools.");
+        }
+        return;
+    }
+    if (target === "claude-desktop") {
+        const bridge = rest.includes("--bridge");
+        const path = await claudeDesktop.connect({ bridge });
+        console.log(`[data-loom] registered DataLoom in Claude Desktop (${bridge ? "stdio bridge" : "native HTTP"}) — ${path}`);
+        console.log("[data-loom] restart Claude Desktop to pick it up; DataLoom must be running to serve the tools.");
+        return;
+    }
+    throw new Error("usage: data-loom connect <claude-code [--on-demand]|claude-desktop [--bridge]>");
 }
 async function runDisconnect(rest) {
-    if (rest[0] !== "claude-desktop")
-        throw new Error("usage: data-loom disconnect claude-desktop");
-    const { path, removed } = await claudeDesktop.disconnect();
-    console.log(removed
-        ? `[data-loom] removed DataLoom from Claude Desktop — ${path}`
-        : "[data-loom] DataLoom was not registered in Claude Desktop — nothing to remove");
+    const target = rest[0];
+    if (target === "claude-code") {
+        const { removed } = await claudeCode.disconnect();
+        console.log(removed
+            ? "[data-loom] removed DataLoom from Claude Code"
+            : "[data-loom] DataLoom was not registered in Claude Code — nothing to remove");
+        return;
+    }
+    if (target === "claude-desktop") {
+        const { path, removed } = await claudeDesktop.disconnect();
+        console.log(removed
+            ? `[data-loom] removed DataLoom from Claude Desktop — ${path}`
+            : "[data-loom] DataLoom was not registered in Claude Desktop — nothing to remove");
+        return;
+    }
+    throw new Error("usage: data-loom disconnect <claude-code|claude-desktop>");
+}
+/** True iff DataLoom is running from an npx / `npm exec` cache rather than a global install. */
+function isNpxInvocation() {
+    return /[\\/]_npx[\\/]/.test(process.argv[1] ?? "");
+}
+/**
+ * `data-loom up [project]` — the one-command setup. Verifies the openspec
+ * prerequisite up front (fail-fast, so a missing prerequisite leaves the
+ * system untouched), then runs the same sequence as `autostart enable`
+ * (register autostart, start the daemon this session, register Claude Code)
+ * and prints a state summary. Idempotent: a re-run on an already-configured
+ * host reports each aspect as already in place instead of duplicating it.
+ * Honors the `--no-start` and `--no-connect` opt-outs.
+ */
+async function runUp(rest) {
+    const project = rest.find((a) => !a.startsWith("--"));
+    const noStart = rest.includes("--no-start");
+    const noConnect = rest.includes("--no-connect");
+    // Prerequisite FIRST, before any setup step — a missing openspec must leave
+    // the system unchanged (no registration, no start, no connect).
+    try {
+        const version = await new OpenSpecClient(resolve(project ?? process.cwd())).checkAvailable();
+        console.log(`[data-loom] openspec CLI ${version}`);
+    }
+    catch {
+        console.error("[data-loom] ERROR: the `openspec` CLI was not found — nothing was changed.\n" +
+            "data_loom does not bundle it; install it separately, then re-run `data-loom up`:\n" +
+            "    npm install -g openspec");
+        process.exit(1);
+    }
+    // Snapshot prior state so the summary can report what was already in place.
+    const wasRunning = await lifecycle.isRunning();
+    const priorEnabled = (await autostart.getRegistrationInfo()).enabled;
+    // 1. Register autostart (idempotent — overwrites any prior registration).
+    const info = await autostart.enable();
+    console.log(`[data-loom] autostart ${priorEnabled ? "already enabled — refreshed" : "enabled"} (${info.mechanism})` +
+        (info.supervised ? "" : " — no crash supervision on this host"));
+    // 2. Bring the daemon up this session — unless the supervisor already did
+    //    (systemd/launchd), it's already running, or the user opted out.
+    let daemonState;
+    if (info.startedNow) {
+        daemonState = "running (launched by the supervisor)";
+    }
+    else if (wasRunning) {
+        daemonState = "already running";
+    }
+    else if (noStart) {
+        daemonState = "not started (--no-start)";
+    }
+    else {
+        await lifecycle.start(project);
+        daemonState = "started";
+    }
+    // 3. Point Claude Code at the daemon (best-effort; --no-connect skips it).
+    let connectState;
+    if (noConnect) {
+        connectState = "skipped (--no-connect)";
+    }
+    else {
+        try {
+            const { registered } = await claudeCode.connect();
+            connectState = registered
+                ? "registered (user scope, native HTTP)"
+                : "not registered — `claude` CLI not found (run the printed command by hand)";
+        }
+        catch (err) {
+            connectState = `not registered — ${err instanceof Error ? err.message : err}`;
+        }
+    }
+    // Summary — doubles as a setup health check when `up` is re-run.
+    const running = await lifecycle.isRunning();
+    console.log("");
+    console.log("[data-loom] setup summary");
+    console.log(`  dashboard:    ${baseUrl()} — ${running ? "running" : "not running"} (${daemonState})`);
+    console.log(`  autostart:    ${info.mechanism}${info.supervised ? " (supervised)" : " (unsupervised)"}`);
+    console.log(`  claude code:  ${connectState}`);
+    console.log("  weave:        run /loom:weave in a Claude Code session to order proposal dependencies");
+    if (isNpxInvocation()) {
+        console.log("");
+        console.log("[data-loom] you launched via npx — for a durable always-on setup, install globally instead:");
+        console.log("    npm install -g @lyric_dev/data-loom");
+    }
 }
 async function runCli(argv) {
     const [verb, ...rest] = argv;
     switch (verb) {
+        case "up":
+            return runUp(rest);
         case "start":
             return lifecycle.start(rest[0]);
         case "stop":
@@ -203,12 +423,16 @@ async function runCli(argv) {
             return lifecycle.restart(rest[0]);
         case "status":
             return lifecycle.status();
+        case "update":
+            return lifecycle.update();
         case "autostart":
             return runAutostart(rest);
         case "connect":
             return runConnect(rest);
         case "disconnect":
             return runDisconnect(rest);
+        case "mcp-shim":
+            return runShim();
         default:
             throw new Error(`unknown command: ${verb}`);
     }

package/dist/lifecycle.js

@@ -5,8 +5,9 @@
 import { spawn } from "node:child_process";
 import { openSync } from "node:fs";
 import { readFile, writeFile, rm } from "node:fs/promises";
-import { get } from "node:http";
+import { get, request } from "node:http";
 import { HOST, PORT, baseUrl, logFile, pidFile, ensureStateDir } from "./paths.js";
+import * as autostart from "./autostart.js";
 /** Probe the loopback endpoint; true iff a daemon answers within the timeout. */
 export function isRunning() {
     return new Promise((resolve) => {
@@ -30,7 +31,39 @@ async function readPid() {
         return undefined;
     }
 }
+/**
+ * Write this process's own PID file. Used when running supervised (an OS
+ * supervisor execs the daemon directly, so there is no parent `start` spawn
+ * to record the child's PID) — keeps `status`/`stop` working the same
+ * whether the daemon was launched via `start` or by a login supervisor.
+ */
+export async function writeSelfPid() {
+    await ensureStateDir();
+    await writeFile(pidFile(), String(process.pid), "utf8");
+}
 const delay = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * Ask the running daemon to shut itself down through its own graceful exit-0
+ * path, via the loopback POST /api/shutdown. This is how a clean stop reaches
+ * exit 0 on Windows, where `process.kill(pid, "SIGTERM")` force-terminates
+ * (exit 1) without running the shutdown handler — which a supervising
+ * Scheduled Task would misread as a crash and restart. Resolves true iff the
+ * daemon accepted the request; false lets the caller fall back to a signal.
+ */
+function requestGracefulShutdown() {
+    return new Promise((resolve) => {
+        const req = request({ host: HOST, port: PORT, path: "/api/shutdown", method: "POST", timeout: 2000 }, (res) => {
+            res.resume(); // drain
+            resolve(res.statusCode === 200);
+        });
+        req.on("error", () => resolve(false));
+        req.on("timeout", () => {
+            req.destroy();
+            resolve(false);
+        });
+        req.end();
+    });
+}
 /**
  * Start the daemon detached from this terminal. If one already answers on the
  * port, this is a reported no-op (single-instance guard). The child re-runs this
@@ -65,7 +98,21 @@ export async function stop() {
         console.log("[data-loom] not running — nothing to stop");
         return;
     }
-    if (pid !== undefined) {
+    // On Linux, prefer stopping through systemd when the supervised unit is
+    // active — keeps the unit's own state consistent with an intentional stop
+    // rather than an out-of-band signal it has to interpret after the fact.
+    if (await autostart.isSystemdUnitActive()) {
+        await autostart.stopSystemdUnit();
+    }
+    else if (running && (await requestGracefulShutdown())) {
+        // The daemon exits 0 through its own shutdown path — the only reliable way
+        // to a clean exit on Windows (see requestGracefulShutdown). Nothing more to
+        // signal; fall through to the port-free wait below.
+    }
+    else if (pid !== undefined) {
+        // Fallback: no graceful endpoint answered (older daemon, or it's hung).
+        // On POSIX this reaches the SIGTERM handler (exit 0); on Windows it force-
+        // terminates (exit 1), which is still correct for an already-wedged daemon.
         try {
             process.kill(pid, "SIGTERM");
         }
@@ -98,4 +145,71 @@ export async function status() {
     else {
         console.log("[data-loom] not running");
     }
+    const reg = await autostart.getRegistrationInfo();
+    if (!reg.enabled) {
+        console.log("[data-loom] autostart: not registered");
+    }
+    else {
+        console.log(`[data-loom] autostart: ${reg.mechanism}${reg.supervised ? " (restarts automatically on crash)" : " (no restart supervision)"}`);
+    }
+}
+async function isGloballyInstalled() {
+    return new Promise((resolve) => {
+        const p = spawn("npm", ["ls", "-g", "@lyric_dev/data-loom", "--depth=0"], {
+            shell: process.platform === "win32",
+            stdio: "ignore",
+        });
+        p.on("error", () => resolve(false));
+        p.on("exit", (code) => resolve(code === 0));
+    });
+}
+function npmInstallLatest() {
+    return new Promise((resolve, reject) => {
+        const p = spawn("npm", ["install", "-g", "@lyric_dev/data-loom@latest"], {
+            shell: process.platform === "win32",
+            stdio: "inherit",
+        });
+        p.on("error", reject);
+        p.on("exit", (code) => (code === 0 ? resolve() : reject(new Error(`npm install exited with code ${code}`))));
+    });
+}
+/**
+ * Upgrade the globally-installed package, restart a running daemon, and
+ * refresh the autostart registration (launcher + task/plist/unit) when one
+ * exists — one command to land on the new version with a healthy always-on
+ * setup. Aborts before any restart/registration step if the upgrade fails,
+ * and never guesses at an upgrade mechanism for a non-global (e.g. npx) run.
+ */
+export async function update() {
+    if (!(await isGloballyInstalled())) {
+        console.log("[data-loom] not installed globally, so it can't self-update.");
+        console.log("[data-loom] run: npm install -g @lyric_dev/data-loom@latest");
+        console.log("[data-loom] (or re-run npx @lyric_dev/data-loom@latest to pick up the new version)");
+        return;
+    }
+    console.log("[data-loom] upgrading @lyric_dev/data-loom...");
+    try {
+        await npmInstallLatest();
+    }
+    catch (err) {
+        console.error(`[data-loom] upgrade failed: ${err instanceof Error ? err.message : err}`);
+        console.error("[data-loom] no restart or re-registration performed.");
+        return;
+    }
+    console.log("[data-loom] upgrade complete.");
+    if (await isRunning()) {
+        console.log("[data-loom] restarting the daemon on the new version...");
+        await restart();
+    }
+    else {
+        console.log("[data-loom] no daemon running — nothing to restart.");
+    }
+    if (await autostart.isEnabled()) {
+        console.log("[data-loom] refreshing the autostart registration...");
+        const info = await autostart.enable();
+        console.log(`[data-loom] autostart re-registered (${info.mechanism}${info.supervised ? ", supervised" : ", no restart supervision"})`);
+    }
+    else {
+        console.log("[data-loom] autostart not enabled — nothing to re-register.");
+    }
 }

package/dist/mcpServer.js

@@ -7,14 +7,15 @@
 // server serves every project: the target project is resolved per call from an
 // explicit `project` argument, falling back to the daemon's current dashboard
 // selection. The server holds no single project frozen for its lifetime.
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
+import { readFile, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { OpenSpecClient } from "./openspecClient.js";
 import { deriveModel } from "./derive.js";
 import { discoverProjects, isViewableProject } from "./projects.js";
+import { provisionWeaveAlias } from "./weaveAlias.js";
+import { VERSION } from "./version.js";
 /**
  * A validation error whose message is safe to return to the client because it
  * only references caller-supplied input (a change name, a path the caller named).
@@ -36,19 +37,15 @@ When you connect, call list_open_proposals (passing the project you are working
 
 Never write a dependency the user has not confirmed. Proposals already marked "declared" need no action.
 
-Tip: call install_weave_skill once to add a \`/loom:weave\` command (written to the user's global Claude config) that runs this whole review in one step; the user reloads Claude Code to pick it up. Register this server once, globally, with: claude mcp add --transport http --scope user data-loom http://127.0.0.1:4317/mcp`;
-// The `/loom:weave` slash command this server installs into the user's global
-// Claude commands dir. Static content that only orchestrates this server's tools.
-const WEAVE_COMMAND = `---
-name: "Loom: Weave"
-description: "Review the open proposals and weave their dependency order via the data-loom MCP server"
-category: Workflow
-tags: [loom, dependencies, mcp, review]
----
+Tip: register this server with \`data-loom connect claude-code\` — it provisions both the MCP registration and the \`/loom:weave\` command in one step, so one reload picks up both. If you registered another way, call install_weave_skill once to add \`/loom:weave\` yourself.`;
+const WEAVE_PROMPT_NAME = "weave";
+const WEAVE_PROMPT_DESCRIPTION = "Review the open proposals and weave their dependency order via the data-loom MCP server";
+// The full review workflow, served as an MCP prompt (the single source of
+// truth — see design.md) and fetched by the thin `/loom:weave` alias installed
+// on disk. Only orchestrates this server's own tools.
+const WEAVE_PROMPT = `Weave the dependency order of this project's open OpenSpec proposals, using the **data-loom** MCP server.
 
-Weave the dependency order of this project's open OpenSpec proposals, using the **data-loom** MCP server.
-
-**Prerequisite:** the DataLoom dashboard daemon must be running and the data-loom MCP server registered in this session — its tools are \`list_open_proposals\`, \`set_dependency\`, \`mark_independent\`, and \`list_projects\`. If those tools are not available, the daemon is almost certainly not running: tell the user to **start DataLoom** (\`npx @lyric_dev/data-loom "<project path>"\`) and, if they have not already, register it once with \`claude mcp add --transport http --scope user data-loom http://127.0.0.1:4317/mcp\`, then stop.
+**Prerequisite:** the DataLoom dashboard daemon must be running and the data-loom MCP server registered in this session — its tools are \`list_open_proposals\`, \`set_dependency\`, \`mark_independent\`, and \`list_projects\`. If those tools are not available, the daemon is almost certainly not running or not registered: tell the user to check \`data-loom status\`, start it with \`data-loom start\` if needed, and register it with \`data-loom connect claude-code\` if needed, then stop.
 
 Steps:
 
@@ -75,7 +72,19 @@ const PROJECT_ARG = {
  * the dashboard selection is the single fallback source of project truth.
  */
 export function createMcpServer(deps) {
-    const server = new Server({ name: "data-loom", version: "0.4.1" }, { capabilities: { tools: {} }, instructions: INSTRUCTIONS });
+    const server = new Server({ name: "data-loom", version: VERSION }, { capabilities: { tools: {}, prompts: {} }, instructions: INSTRUCTIONS });
+    server.setRequestHandler(ListPromptsRequestSchema, async () => ({
+        prompts: [{ name: WEAVE_PROMPT_NAME, description: WEAVE_PROMPT_DESCRIPTION }],
+    }));
+    server.setRequestHandler(GetPromptRequestSchema, async (req) => {
+        if (req.params.name !== WEAVE_PROMPT_NAME) {
+            throw new ToolError(`unknown prompt: ${req.params.name}`);
+        }
+        return {
+            description: WEAVE_PROMPT_DESCRIPTION,
+            messages: [{ role: "user", content: { type: "text", text: WEAVE_PROMPT } }],
+        };
+    });
     // Resolve the target project for a call: explicit arg, then dashboard
     // selection, then an instructive error. Validated as a real workspace before
     // any read or write.
@@ -135,7 +144,7 @@ export function createMcpServer(deps) {
             },
             {
                 name: "install_weave_skill",
-                description: "Install the `/loom:weave` slash command into the user's global Claude commands directory (~/.claude/commands/loom/weave.md), so this dependency review can be run as a single command from any project. Writes a static command file only (no project data or secrets) and overwrites any existing copy. Run once, then the user reloads Claude Code.",
+                description: "Install the `/loom:weave` slash command into the user's global Claude commands directory (~/.claude/commands/loom/weave.md) — a thin, version-stamped alias that fetches and follows this server's `weave` prompt, so this dependency review can be run as a single command from any project. `data-loom connect claude-code` already provisions this automatically; use this tool as a fallback when the command registered another way. Writes a static alias file only (no project data or secrets) and overwrites any existing copy. Run once, then the user reloads Claude Code.",
                 inputSchema: { type: "object", properties: {}, additionalProperties: false },
             },
         ],
@@ -246,15 +255,12 @@ async function markIndependent(client, changesDir, project, change) {
     return { project, change, written, dependencyReview: "declared" };
 }
 /**
- * Provision the `/loom:weave` command into the user's GLOBAL Claude commands
- * dir, so the review runs as one command from any project. Writes only the
- * static command file; overwrites in place.
+ * Provision the `/loom:weave` alias into the user's GLOBAL Claude commands
+ * dir, so the review runs as one command from any project. The alias delegates
+ * to this server's `weave` prompt; see weaveAlias.ts.
  */
 async function installWeaveSkill() {
-    const dir = join(homedir(), ".claude", "commands", "loom");
-    const path = join(dir, "weave.md");
-    await mkdir(dir, { recursive: true });
-    await writeFile(path, WEAVE_COMMAND);
+    const path = await provisionWeaveAlias(VERSION);
     return {
         installed: true,
         command: "/loom:weave",