@mokoconsulting/mcp-mokosuite 1.0.0 → 1.1.0-dev.372

package/.mokogit/workflows/npm-build-test.yml

@@ -2,8 +2,16 @@
 # Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
-# Builds the MCP server, validates TypeScript compilation, and checks
-# that tools are properly registered with valid Zod schemas.
+# Builds the MCP server via the centralized MokoCLI build agent
+# (moko lint|build|test), then validates that compiled output exists and that
+# tools are properly registered. The build agent is platform-aware via the
+# repo's NATIVE manifest (package.json) — no metadata API call — so inline
+# npm install / npx tsc / npm run build / npm test are no longer needed here.
+#
+# GATE: `moko` is provided by mokocli on the runner PATH (/opt/mokocli/cli).
+# It becomes available only after the mokocli build agent lands on `main` and
+# the runner image is rebuilt. Until then this workflow is authored/reviewed
+# but should not be expected to run green.
 
 name: "MCP: Build & Validate"
 
@@ -18,6 +26,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: write
 
 env:
   MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
@@ -47,22 +56,57 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
 
-      - name: Install dependencies
-        run: npm ci
+      - name: Setup MokoCLI build agent (moko on PATH)
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+        run: |
+          # Reach mokocli the SAME way the release workflows' "Setup MokoCLI tools"
+          # step does: prefer the pre-installed /opt/mokocli, else fall back to a
+          # fresh clone. The only difference is we expose the `moko` binary on PATH
+          # (mokocli's cli/ dir) so `moko build|test|lint` resolve — we do NOT invent
+          # a new install mechanism.
+          if [ -x /opt/mokocli/cli/moko ] || [ -f /opt/mokocli/cli/moko ]; then
+            echo Using pre-installed /opt/mokocli
+            echo "/opt/mokocli/cli" >> "$GITHUB_PATH"
+          else
+            echo Falling back to fresh clone
+            MOKO_CLONE_TOKEN="$(printf '%s' "${MOKO_CLONE_TOKEN}" | tr -d '[:space:]')"
+            echo "::add-mask::${MOKO_CLONE_TOKEN}"
+            if [ -z "${MOKO_CLONE_TOKEN}" ]; then
+              echo "::error::MOKOGIT_TOKEN secret is empty — cannot clone mokocli fallback." >&2
+              exit 1
+            fi
+            if ! command -v composer > /dev/null 2>&1; then
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            fi
+            rm -rf /tmp/mokocli
+            CLONE_URL="https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git"
+            git clone --depth 1 --branch main --quiet "${CLONE_URL}" /tmp/mokocli
+            ( cd /tmp/mokocli && composer install --no-dev --no-interaction --no-progress --optimize-autoloader --quiet )
+            echo "/tmp/mokocli/cli" >> "$GITHUB_PATH"
+          fi
 
-      - name: TypeScript compile
-        run: npx tsc --noEmit
+      - name: Lint
+        run: moko lint
 
       - name: Build
-        run: npm run build
+        run: moko build
+
+      - name: Test
+        run: moko test
 
       - name: Verify dist output exists
         run: |
+          # dist/index.js is the bin/main entry for every MCP server (shared
+          # package.json convention). Assert that + that the build emitted
+          # compiled output. Do NOT hard-code other filenames: source layouts
+          # differ per server (many have no client.ts/types.ts/root config.ts),
+          # which false-failed this check on every build fleet-wide.
           test -f dist/index.js || (echo "ERROR: dist/index.js not found" && exit 1)
-          test -f dist/client.js || (echo "ERROR: dist/client.js not found" && exit 1)
-          test -f dist/config.js || (echo "ERROR: dist/config.js not found" && exit 1)
-          test -f dist/types.js || (echo "ERROR: dist/types.js not found" && exit 1)
-          echo "✓ All required dist files present"
+          JS_COUNT=$(find dist -name '*.js' | wc -l)
+          [ "${JS_COUNT}" -gt 0 ] || (echo "ERROR: no compiled .js files in dist/" && exit 1)
+          echo "✓ dist/index.js present; ${JS_COUNT} compiled .js file(s) in dist/"
 
       - name: Verify shebang in index.js
         run: |
@@ -70,14 +114,54 @@ jobs:
 
       - name: Count registered tools
         run: |
-          INDEX_FILE="${{ steps.srcdir.outputs.source_dir }}index.ts"
-          if [ ! -f "${INDEX_FILE}" ]; then
-            echo "::warning::resolved entrypoint ${INDEX_FILE} missing; falling back to src/index.ts"
-            INDEX_FILE="src/index.ts"
-          fi
-          TOOL_COUNT=$(grep -c "server\.tool(" "${INDEX_FILE}" || true)
-          echo "Registered tools in ${INDEX_FILE}: ${TOOL_COUNT}"
+          # Tools may be registered in the entry file OR in modules it imports
+          # (modular servers call server.tool( / .registerTool( inside
+          # source/tools/*.ts). Count registrations across the whole source
+          # tree, not just index.ts, else modular servers false-report zero.
+          SRC_DIR="${{ steps.srcdir.outputs.source_dir }}"
+          [ -n "${SRC_DIR}" ] && [ -d "${SRC_DIR}" ] || SRC_DIR="source"
+          [ -d "${SRC_DIR}" ] || SRC_DIR="src"
+          TOOL_COUNT=$(grep -rE "server\.tool\(|\.registerTool\(" "${SRC_DIR}" 2>/dev/null | wc -l | tr -d ' ')
+          echo "Registered tool calls under ${SRC_DIR}: ${TOOL_COUNT}"
           if [ "${TOOL_COUNT}" -eq 0 ]; then
-            echo "ERROR: No tools registered in ${INDEX_FILE}"
+            echo "ERROR: No tools registered under ${SRC_DIR}"
             exit 1
           fi
+
+  ci-summary:
+    name: CI Summary (sticky comment)
+    runs-on: ubuntu-latest
+    needs: [build]
+    if: always()
+    steps:
+      - name: Upsert sticky CI summary comment
+        env:
+          TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
+          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+          BUILD: ${{ needs.build.result }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          HEAD_REF: ${{ github.head_ref }}
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          set -uo pipefail
+          { [ -n "${TOKEN:-}" ] && [ -n "${PR:-}" ]; } || { echo "no token/PR; skip"; exit 0; }
+          icon() { case "$1" in success) printf '✅';; failure) printf '❌';; skipped) printf '⏭️';; *) printf '⚪';; esac; }
+          MARKER="<!-- ci-summary -->"
+          BODY="$(printf '%s\n## MCP Build & Validate\n\n- %s Build & validate (`%s` → `%s`)\n\n_Updated %s · [run](%s)_' \
+            "${MARKER}" \
+            "$(icon "${BUILD}")" "${HEAD_REF}" "${BASE_REF}" \
+            "$(date -u +%FT%TZ)" "${RUN_URL}")"
+          LIST="${SERVER}/api/v1/repos/${REPO}/issues/${PR}/comments"
+          EDIT="${SERVER}/api/v1/repos/${REPO}/issues/comments"
+          CID="$(curl -sf -H "Authorization: token ${TOKEN}" "${LIST}?limit=100" 2>/dev/null \
+                 | python3 -c "import sys,json; c=[x for x in json.load(sys.stdin) if '${MARKER}' in (x.get('body') or '')]; print(c[-1]['id'] if c else '')" 2>/dev/null || true)"
+          PAYLOAD="$(python3 -c "import json,sys; print(json.dumps({'body': sys.stdin.read()}))" <<<"${BODY}")"
+          if [ -n "${CID}" ]; then
+            curl -sf -X PATCH -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -d "${PAYLOAD}" "${EDIT}/${CID}" >/dev/null 2>&1 || true
+            echo "updated sticky CI summary #${CID} on PR #${PR}"
+          else
+            curl -sf -X POST  -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -d "${PAYLOAD}" "${LIST}" >/dev/null 2>&1 || true
+            echo "created sticky CI summary on PR #${PR}"
+          fi

package/.mokogit/workflows/npm-prerelease.yml

@@ -0,0 +1,174 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-NPM
+# PATH: /.mokogit/workflows/npm-prerelease.yml
+# VERSION: 02.00.00
+# BRIEF: Pre-release (dev/alpha/beta/rc) npm publishing for npm-family repos. Split
+#        out of the universal pre-release.yml (Template-Generic 06.01.00) so npm
+#        dist-tag publishing lives ONLY in the npm template. Build + publish now
+#        delegate to the centralized MokoCLI build agent (moko build / moko
+#        publish); `moko publish` preserves the same dev-channel dist-tag publish
+#        to npmjs.org + the MokoGIT npm registry that the former inline block did.
+#        npm-publish.yml handles STABLE (latest) on main; this handles the dev
+#        channel on dev.
+#
+# GATE: `moko` is provided by mokocli on the runner PATH (/opt/mokocli/cli),
+# available only after the mokocli build agent lands on `main` and the runner
+# image is rebuilt — authored/reviewed now, runs green later.
+
+name: "Publish to npm (pre-release channel)"
+
+on:
+  # Dev-channel publish on every merge to dev. paths-ignore is a non-code denylist:
+  # a push touching only docs / CI config / repo metadata does not publish. The
+  # concurrency guard below collapses a burst of merges into one.
+  push:
+    branches:
+      - dev
+    paths-ignore:
+      - '.mokogit/**'
+      - '.gitea/**'
+      - '.github/**'
+      - '.vscode/**'
+      - '.idea/**'
+      - 'docs/**'
+      - 'wiki/**'
+      - '**/*.md'
+      - '.editorconfig'
+      - '.gitignore'
+      - '.gitattributes'
+      - '.gitmodules'
+      - '.gitmessage'
+      - 'LICENSE'
+  schedule:
+    # Nightly at 07:00 UTC — safety-net batch for any dev merge a push publish missed.
+    - cron: '0 7 * * *'
+  workflow_dispatch:
+    inputs:
+      stability:
+        description: 'Pre-release channel'
+        required: true
+        default: development
+        type: choice
+        options:
+          - development
+          - alpha
+          - beta
+          - release-candidate
+      ref:
+        description: 'Branch to build (default: dev)'
+        required: false
+        default: dev
+        type: string
+
+concurrency:
+  group: npm-prerelease-${{ github.ref }}-${{ inputs.stability || 'development' }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: "npm pre-release (${{ inputs.stability || 'development' }})"
+    runs-on: release
+    # Skip on template repos (Template-*) — they scaffold other repos and do not
+    # release. Triggers: push to dev, the nightly schedule, and manual dispatch.
+    # As defence-in-depth we also refuse a manual dispatch aimed at a bot/sync ref
+    # (mirrors pre-release.yml).
+    if: >-
+      !startsWith(github.event.repository.name, 'Template-') &&
+      (
+        github.event_name == 'push' ||
+        github.event_name == 'schedule' ||
+        (
+          github.event_name == 'workflow_dispatch' &&
+          !startsWith(inputs.ref, 'chore/') &&
+          !startsWith(inputs.ref, 'sync/') &&
+          !startsWith(inputs.ref, 'bot/') &&
+          !startsWith(inputs.ref, 'mokoonyx-template-sync') &&
+          !startsWith(inputs.ref, 'template-sync')
+        )
+      )
+    steps:
+      # Build ref: the dispatch input if given, else `dev` — correct for both a push
+      # (only `dev` triggers it) and the nightly schedule (where github.ref_name
+      # would otherwise be the default branch, main).
+      - name: Resolve build ref
+        id: ref
+        run: echo "ref=${{ inputs.ref || 'dev' }}" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.ref.outputs.ref }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Setup MokoCLI build agent (moko on PATH)
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+        run: |
+          # Reach mokocli the SAME way the release workflows' "Setup MokoCLI tools"
+          # step does: prefer the pre-installed /opt/mokocli, else a fresh clone. We
+          # expose the `moko` binary on PATH so `moko build|publish` resolve — no new
+          # install mechanism is introduced.
+          if [ -x /opt/mokocli/cli/moko ] || [ -f /opt/mokocli/cli/moko ]; then
+            echo Using pre-installed /opt/mokocli
+            echo "/opt/mokocli/cli" >> "$GITHUB_PATH"
+          else
+            echo Falling back to fresh clone
+            MOKO_CLONE_TOKEN="$(printf '%s' "${MOKO_CLONE_TOKEN}" | tr -d '[:space:]')"
+            echo "::add-mask::${MOKO_CLONE_TOKEN}"
+            if [ -z "${MOKO_CLONE_TOKEN}" ]; then
+              echo "::error::MOKOGIT_TOKEN secret is empty — cannot clone mokocli fallback." >&2
+              exit 1
+            fi
+            if ! command -v composer > /dev/null 2>&1; then
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            fi
+            rm -rf /tmp/mokocli
+            CLONE_URL="https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git"
+            git clone --depth 1 --branch main --quiet "${CLONE_URL}" /tmp/mokocli
+            ( cd /tmp/mokocli && composer install --no-dev --no-interaction --no-progress --optimize-autoloader --quiet )
+            echo "/tmp/mokocli/cli" >> "$GITHUB_PATH"
+          fi
+
+      - name: Build
+        run: moko build
+
+      # dev/rc/beta/alpha channel maps to the matching npm dist-tag; the version is
+      # <base>-<tag>.<run_number> so it is unique per run and npm won't reject it.
+      # The nightly schedule always publishes the development channel. Repos without
+      # an NPM_TOKEN secret warn-and-skip rather than fail the run. Published to
+      # npmjs.org AND the MokoGIT npm registry (matching npm-publish.yml). A
+      # per-registry publish that fails because the version already exists is a
+      # warning, not a failure — the run only fails if BOTH registries reject it.
+      # moko publish preserves that dist-tag / dual-registry behavior; it derives
+      # the channel from --stability (schedule → development).
+      - name: Publish npm package (pre-release channel)
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+        run: |
+          set -uo pipefail
+          if [ -z "${NPM_TOKEN}" ]; then
+            echo "::warning::NPM_TOKEN not set — skipping npm pre-release publish"
+            exit 0
+          fi
+          if [ "${{ github.event_name }}" = "schedule" ]; then
+            STABILITY=development
+          else
+            STABILITY="${{ inputs.stability || 'development' }}"
+          fi
+          moko publish --stability "$STABILITY"

package/.mokogit/workflows/npm-publish.yml

@@ -7,12 +7,19 @@
 # INGROUP: MokoCLI.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-NPM
 # PATH: /.mokogit/workflows/npm-publish.yml
-# VERSION: 02.00.00
+# VERSION: 03.00.00
 # BRIEF: Build + publish shim. The shared release engine (pre-release.yml /
 #        auto-release.yml) owns version bump, tag, changelog and release
 #        object; this workflow only builds and publishes the version the
 #        engine has already written to package.json. It never bumps or
-#        writes the version.
+#        writes the version. Build + publish now delegate to the centralized
+#        MokoCLI build agent (moko build / moko publish); `moko publish`
+#        preserves the same dual-registry npm publish (npmjs.org + the MokoGIT
+#        npm registry) that the former inline block performed.
+#
+# GATE: `moko` is provided by mokocli on the runner PATH (/opt/mokocli/cli),
+# available only after the mokocli build agent lands on `main` and the runner
+# image is rebuilt — authored/reviewed now, runs green later.
 
 name: "Publish to npm"
 
@@ -85,13 +92,40 @@ jobs:
         with:
           node-version: '20'
 
-      - name: Install dependencies
+      - name: Setup MokoCLI build agent (moko on PATH)
         if: steps.detect.outputs.changed == 'true'
-        run: npm install --no-audit --no-fund
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+        run: |
+          # Reach mokocli the SAME way the release workflows' "Setup MokoCLI tools"
+          # step does: prefer the pre-installed /opt/mokocli, else a fresh clone. We
+          # expose the `moko` binary on PATH so `moko build|publish` resolve — no new
+          # install mechanism is introduced.
+          if [ -x /opt/mokocli/cli/moko ] || [ -f /opt/mokocli/cli/moko ]; then
+            echo Using pre-installed /opt/mokocli
+            echo "/opt/mokocli/cli" >> "$GITHUB_PATH"
+          else
+            echo Falling back to fresh clone
+            MOKO_CLONE_TOKEN="$(printf '%s' "${MOKO_CLONE_TOKEN}" | tr -d '[:space:]')"
+            echo "::add-mask::${MOKO_CLONE_TOKEN}"
+            if [ -z "${MOKO_CLONE_TOKEN}" ]; then
+              echo "::error::MOKOGIT_TOKEN secret is empty — cannot clone mokocli fallback." >&2
+              exit 1
+            fi
+            if ! command -v composer > /dev/null 2>&1; then
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            fi
+            rm -rf /tmp/mokocli
+            CLONE_URL="https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git"
+            git clone --depth 1 --branch main --quiet "${CLONE_URL}" /tmp/mokocli
+            ( cd /tmp/mokocli && composer install --no-dev --no-interaction --no-progress --optimize-autoloader --quiet )
+            echo "/tmp/mokocli/cli" >> "$GITHUB_PATH"
+          fi
 
       - name: Build
         if: steps.detect.outputs.changed == 'true'
-        run: npm run build
+        run: moko build
 
       - name: Read version to publish
         id: version
@@ -109,18 +143,11 @@ jobs:
       - name: Publish to npmjs.org + git.mokoconsulting.tech
         if: steps.detect.outputs.changed == 'true'
         run: |
-          set -uo pipefail
-          {
-            echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}"
-            echo "//git.mokoconsulting.tech/api/packages/MokoConsulting/npm/:_authToken=${MOKOGIT_TOKEN}"
-          } >> .npmrc
-          VER=$(node -p "require('./package.json').version")
-          rc=0
-          echo "Publishing ${VER} -> npmjs.org"
-          npm publish --access public --registry https://registry.npmjs.org/             || { echo "::warning::npmjs.org publish failed (version ${VER} may already exist)"; rc=$((rc+1)); }
-          echo "Publishing ${VER} -> git.mokoconsulting.tech"
-          npm publish --access public --registry https://git.mokoconsulting.tech/api/packages/MokoConsulting/npm/             || { echo "::warning::git.mokoconsulting.tech publish failed (version ${VER} may already exist)"; rc=$((rc+1)); }
-          [ "$rc" -lt 2 ]
+          # moko publish preserves the former inline behavior: idempotent dual-registry
+          # npm publish to npmjs.org AND the MokoGIT npm registry, publishing the version
+          # the release engine already wrote to package.json (never bumps). It reads the
+          # registry auth tokens from the environment below.
+          moko publish
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}