@mycompbox/compbox-mcp 1.21.3 → 1.21.5

package/index.js

@@ -130,7 +130,7 @@ var init_mailbox = __esm({
       "failed"
     ];
     TURN_ROLES = ["agent", "user"];
-    START_EXECUTION_KINDS = ["plan", "orchestrate"];
+    START_EXECUTION_KINDS = ["plan", "orchestrate", "refine"];
   }
 });
 
@@ -863,6 +863,18 @@ var init_interview_completion = __esm({
 });
 
 // ../shared/dist/interview-conversation.js
+function requestLockReason(saved) {
+  if (!saved)
+    return null;
+  if (saved.status !== "pending")
+    return "status";
+  if (!saved.canEdit)
+    return "ownership";
+  return null;
+}
+function lockedRequestMessage(reason) {
+  return reason === "ownership" ? "Only the request's creator can change it; you can still discuss it." : "This request is locked, so it can't be changed any more.";
+}
 function renderSection(s) {
   const tag = s.required ? "needed" : "nice to have";
   return `- ${s.title} (${tag}): ${s.purpose} For example: ${s.followUps.slice(0, 2).join(" ")}`;
@@ -873,8 +885,10 @@ function renderSaved(saved) {
   const issues = saved.compliance && saved.compliance.issues.length > 0 ? `
 What the score says is missing or weak:
 ${saved.compliance.issues.slice(0, 8).map((i) => `- ${i.message}`).join("\n")}` : "";
-  const locked = saved.status === "pending" ? "It can still be changed." : `Its status is "${saved.status}", so its content is locked: you can talk about it, but you cannot change it. Never emit the completion JSON for a locked request.`;
-  return `THE REQUEST IS ALREADY SAVED. This conversation created the request "${saved.title}". ${score} ${locked}${issues}
+  const reason = requestLockReason(saved);
+  const locked = reason === null ? "It can still be changed." : reason === "status" ? `Its status is "${saved.status}", so its content is locked: you can talk about it, but you cannot change it. Never emit the completion JSON for a locked request.` : "Only the request's creator can change it, and the person you're talking to is not its creator, so its content is locked for them: you can talk about it, but you cannot change it. Never emit the completion JSON for a locked request. If they ask for a change, explain that only the creator can make it.";
+  const origin = saved.discussed ? `THE REQUEST ALREADY EXISTS. The person is discussing the existing request "${saved.title}"; this conversation did not create it.` : `THE REQUEST IS ALREADY SAVED. This conversation created the request "${saved.title}".`;
+  return `${origin} ${score} ${locked}${issues}
 
 Its current content:
 title: ${saved.title}
@@ -950,7 +964,7 @@ ${followUp}` : text;
 async function runConversationStep(input, deps) {
   const system = buildConversationSystemPrompt(input.saved);
   const messages = toConversationMessages(input.turns);
-  const locked = input.saved !== null && input.saved.status !== "pending";
+  const lockReason = requestLockReason(input.saved);
   let requestId = input.saved?.id ?? null;
   let savedNow = null;
   let createdHere = false;
@@ -973,10 +987,11 @@ Send another message (for example "try again") when you're ready and I'll pick u
     }
     const draft = extractCompletionJson(reply);
     if (draft) {
-      if (locked) {
-        messages.push({ role: "assistant", content: reply }, { role: "user", content: "That request is locked and can't be changed. Reply to me in plain text instead." });
+      if (lockReason) {
+        const why = lockReason === "ownership" ? "Only the request's creator can change it, and I'm not its creator." : "That request is locked and can't be changed.";
+        messages.push({ role: "assistant", content: reply }, { role: "user", content: `${why} Reply to me in plain text instead.` });
         if (++repairs > JSON_REPAIRS)
-          return { kind: "error", text: "This request is locked, so it can't be changed any more." };
+          return { kind: "error", text: lockedRequestMessage(lockReason) };
         continue;
       }
       let saved;
@@ -1019,7 +1034,7 @@ The request IS already saved, and the person will be shown its score. If you ask
     return { kind: "message", text };
   }
 }
-function savedContextFromRecord(record) {
+function savedContextFromRecord(record, access) {
   if (typeof record !== "object" || record === null)
     return null;
   const r = record;
@@ -1054,7 +1069,9 @@ function savedContextFromRecord(record) {
     status: typeof r.status === "string" ? r.status : "pending",
     description: typeof r.description === "string" ? r.description : "",
     fields,
-    compliance: complianceFromRecord(score)
+    compliance: complianceFromRecord(score),
+    canEdit: access.canEdit,
+    ...access.discussed ? { discussed: true } : {}
   };
 }
 function complianceFromRecord(score) {
@@ -2048,6 +2065,7 @@ __export(dist_exports, {
   isSubscriptionStatus: () => isSubscriptionStatus,
   isTurnRole: () => isTurnRole,
   isValidModelId: () => isValidModelId,
+  lockedRequestMessage: () => lockedRequestMessage,
   looksLikeCompletionAttempt: () => looksLikeCompletionAttempt,
   mcpConfigSchema: () => mcpConfigSchema,
   mcpServerConfigSchema: () => mcpServerConfigSchema,
@@ -2057,6 +2075,7 @@ __export(dist_exports, {
   ok: () => ok,
   probeProxyHealth: () => probeProxyHealth,
   renderConversationPrompt: () => renderConversationPrompt,
+  requestLockReason: () => requestLockReason,
   resolveRouting: () => resolveRouting,
   runConversationStep: () => runConversationStep,
   safeReturnTo: () => safeReturnTo,
@@ -2927,6 +2946,14 @@ var ApiClient = class {
       throw error;
     }
   }
+  /**
+   * The cloud a project deploys to: its own choice, or the organization's
+   * default (veena-gcp style). `cloudConnectionId: null` on a team does NOT mean
+   * "no cloud" — it means "follows the org default"; this resolves it.
+   */
+  async getProjectCloud(teamId) {
+    return this.request("GET", `/api/v1/teams/${encodeURIComponent(teamId)}/cloud`);
+  }
   // ---------------------------------------------------------------------------
   // Personal Scope Methods
   // ---------------------------------------------------------------------------
@@ -10487,6 +10514,7 @@ function isUuid(value) {
 }
 
 // src/tools/teams.ts
+import { z as z20 } from "zod";
 function registerTeamTools(server2) {
   server2.registerTool(
     "compbox__list_teams",
@@ -10516,22 +10544,59 @@ function registerTeamTools(server2) {
       }
     }
   );
+  server2.registerTool(
+    "compbox__get_project_cloud",
+    {
+      description: "Get the cloud a project (team) deploys to: provider (gcp/aws/azure), cloud project or account ID, region and deploy identity, and whether it is the project's own choice or the organization's default. A team's cloudConnectionId of null means it FOLLOWS THE ORG DEFAULT, not that it has no cloud; always call this before planning hosting, databases or deployment. Returns cloud: null only when the organization has no cloud connected.",
+      inputSchema: {
+        team: z20.string().min(1).describe("The project/team: UUID, name or key (e.g. 'SAISUD').")
+      }
+    },
+    async (input) => {
+      try {
+        const apiClient = getApiClient();
+        const found = await apiClient.getTeam(input.team);
+        if (!found) {
+          return createErrorResponse(new Error(`Team '${input.team}' not found`));
+        }
+        const { data } = await apiClient.getProjectCloud(found.data.id);
+        const cloud = data.cloud;
+        return createResponse({
+          team: { id: found.data.id, name: found.data.name, key: found.data.key },
+          hasCloud: cloud !== null,
+          source: cloud === null ? "none" : data.isInherited ? "organization-default" : "project-choice",
+          cloud: cloud && {
+            name: cloud.name,
+            provider: cloud.provider,
+            projectId: cloud.projectId,
+            region: cloud.region,
+            serviceAccountEmail: cloud.serviceAccountEmail,
+            stateStore: cloud.stateStore,
+            consoleUrl: cloud.consoleUrl
+          },
+          guidance: cloud === null ? "No cloud is connected. An organization admin can connect one in Settings -> Cloud; until then don't assume a hosting provider." : `Plan hosting, databases and storage on ${cloud.provider.toUpperCase()} (${cloud.projectId}, ${cloud.region}). CompBox stacks deploy through GitHub Actions with keyless sign-in, so never plan stored cloud keys.`
+        });
+      } catch (error) {
+        return createErrorResponse(error);
+      }
+    }
+  );
 }
 
 // src/tools/team-hierarchy.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var createTeamChildSchema = {
-  parentId: z20.string().uuid().describe("The UUID of the parent team that will own the new child team."),
-  name: z20.string().min(1).max(255).describe("Display name for the child team."),
-  key: z20.string().min(1).max(10).regex(/^[A-Z][A-Z0-9-]*$/).describe("Unique team key for the child team. Must start with an uppercase letter and contain only uppercase letters, digits, or hyphens."),
-  level: z20.enum(["group", "product-line", "product", "discipline"]).describe("Hierarchy level for the child team (required).")
+  parentId: z21.string().uuid().describe("The UUID of the parent team that will own the new child team."),
+  name: z21.string().min(1).max(255).describe("Display name for the child team."),
+  key: z21.string().min(1).max(10).regex(/^[A-Z][A-Z0-9-]*$/).describe("Unique team key for the child team. Must start with an uppercase letter and contain only uppercase letters, digits, or hyphens."),
+  level: z21.enum(["group", "product-line", "product", "discipline"]).describe("Hierarchy level for the child team (required).")
 };
 var getTeamPathSchema = {
-  teamId: z20.string().uuid().describe("The UUID of the team whose ordered ancestor path should be returned.")
+  teamId: z21.string().uuid().describe("The UUID of the team whose ordered ancestor path should be returned.")
 };
 var moveTeamSchema = {
-  teamId: z20.string().uuid().describe("The UUID of the team to move within the hierarchy."),
-  newParentId: z20.string().uuid().nullable().describe("The UUID of the new parent team. Pass null to move the team to the root level.")
+  teamId: z21.string().uuid().describe("The UUID of the team to move within the hierarchy."),
+  newParentId: z21.string().uuid().nullable().describe("The UUID of the new parent team. Pass null to move the team to the root level.")
 };
 function registerTeamHierarchyTools(server2) {
   server2.registerTool(
@@ -10631,7 +10696,7 @@ function registerTeamHierarchyTools(server2) {
 
 // src/tools/composite.ts
 init_dist();
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var COMPOSITE_TIMEOUT_MS = 12e4;
 function withTimeout(promise, ms, operationName) {
   return new Promise((resolve, reject) => {
@@ -10657,41 +10722,41 @@ function withTimeout(promise, ms, operationName) {
 var estimatedComplexityValues = ["trivial", "simple", "moderate", "complex"];
 var estimatedEffortValues = ["trivial", "small", "medium", "large", "xl"];
 var riskLevelValues = ["low", "medium", "high"];
-var externalLinkSchema = z21.object({
-  url: z21.string().describe("URL of the external resource"),
-  title: z21.string().describe("Display title for the link")
+var externalLinkSchema = z22.object({
+  url: z22.string().describe("URL of the external resource"),
+  title: z22.string().describe("Display title for the link")
 });
-var structuredDescSchema = z21.object({
-  summary: z21.string().describe("Brief human-readable summary (required)"),
-  aiInstructions: z21.string().optional().describe("Specific instructions for AI agents implementing this item"),
-  acceptanceCriteria: z21.array(z21.string()).optional().describe("List of acceptance criteria that must be met"),
-  filesInvolved: z21.array(z21.string()).optional().describe("File paths that will be involved in this work"),
-  functionsToModify: z21.array(z21.string()).optional().describe("Functions to modify in format 'filePath:functionName'"),
-  testingStrategy: z21.string().optional().describe("Description of how this work should be tested"),
-  testFiles: z21.array(z21.string()).optional().describe("Test file paths"),
-  relatedItemIds: z21.array(z21.string()).optional().describe("Related feature or task identifiers"),
-  externalLinks: z21.array(externalLinkSchema).optional().describe("External documentation or reference links"),
-  technicalNotes: z21.string().optional().describe("Technical implementation notes or constraints"),
-  riskLevel: z21.enum(riskLevelValues).optional().describe("Risk level assessment: low, medium, or high"),
-  estimatedEffort: z21.enum(estimatedEffortValues).optional().describe("Effort estimate: trivial, small, medium, large, or xl")
+var structuredDescSchema = z22.object({
+  summary: z22.string().describe("Brief human-readable summary (required)"),
+  aiInstructions: z22.string().optional().describe("Specific instructions for AI agents implementing this item"),
+  acceptanceCriteria: z22.array(z22.string()).optional().describe("List of acceptance criteria that must be met"),
+  filesInvolved: z22.array(z22.string()).optional().describe("File paths that will be involved in this work"),
+  functionsToModify: z22.array(z22.string()).optional().describe("Functions to modify in format 'filePath:functionName'"),
+  testingStrategy: z22.string().optional().describe("Description of how this work should be tested"),
+  testFiles: z22.array(z22.string()).optional().describe("Test file paths"),
+  relatedItemIds: z22.array(z22.string()).optional().describe("Related feature or task identifiers"),
+  externalLinks: z22.array(externalLinkSchema).optional().describe("External documentation or reference links"),
+  technicalNotes: z22.string().optional().describe("Technical implementation notes or constraints"),
+  riskLevel: z22.enum(riskLevelValues).optional().describe("Risk level assessment: low, medium, or high"),
+  estimatedEffort: z22.enum(estimatedEffortValues).optional().describe("Effort estimate: trivial, small, medium, large, or xl")
 });
-var compositeTaskSchema = z21.object({
-  title: z21.string().min(1).max(500).describe("Task title (required)"),
-  executionOrder: z21.number().int().positive().optional().describe("Execution order within the feature (1, 2, 3...). Lower numbers first."),
-  estimatedComplexity: z21.enum(estimatedComplexityValues).optional().describe("Complexity: trivial (<1hr), simple (1-4hr), moderate (1-3d), complex (>3d)"),
+var compositeTaskSchema = z22.object({
+  title: z22.string().min(1).max(500).describe("Task title (required)"),
+  executionOrder: z22.number().int().positive().optional().describe("Execution order within the feature (1, 2, 3...). Lower numbers first."),
+  estimatedComplexity: z22.enum(estimatedComplexityValues).optional().describe("Complexity: trivial (<1hr), simple (1-4hr), moderate (1-3d), complex (>3d)"),
   structuredDesc: structuredDescSchema.optional().describe("Structured description with summary, aiInstructions, acceptanceCriteria, etc.")
 });
-var compositeFeatureSchema = z21.object({
-  title: z21.string().min(1).max(500).describe("Feature title (required)"),
-  executionOrder: z21.number().int().positive().describe("Execution order within the epic (required). Lower numbers first."),
-  estimatedComplexity: z21.enum(estimatedComplexityValues).describe("Complexity (required): trivial, simple, moderate, or complex"),
-  canParallelize: z21.boolean().optional().describe("Whether this feature can run alongside other features in parallel"),
-  parallelGroup: z21.string().max(100).optional().describe("Group identifier for features that can run together"),
-  dependencies: z21.array(z21.number().int().min(0)).optional().describe(
+var compositeFeatureSchema = z22.object({
+  title: z22.string().min(1).max(500).describe("Feature title (required)"),
+  executionOrder: z22.number().int().positive().describe("Execution order within the epic (required). Lower numbers first."),
+  estimatedComplexity: z22.enum(estimatedComplexityValues).describe("Complexity (required): trivial, simple, moderate, or complex"),
+  canParallelize: z22.boolean().optional().describe("Whether this feature can run alongside other features in parallel"),
+  parallelGroup: z22.string().max(100).optional().describe("Group identifier for features that can run together"),
+  dependencies: z22.array(z22.number().int().min(0)).optional().describe(
     "Array of 0-based indices referencing earlier features in this array that must complete first"
   ),
   structuredDesc: structuredDescSchema.optional().describe("Structured description with summary, aiInstructions, acceptanceCriteria, etc."),
-  tasks: z21.array(compositeTaskSchema).min(1).describe("Array of tasks for this feature (at least 1 required)")
+  tasks: z22.array(compositeTaskSchema).min(1).describe("Array of tasks for this feature (at least 1 required)")
 });
 function registerCompositeTools(server2) {
   server2.registerTool(
@@ -10721,19 +10786,19 @@ Use this instead of individual create calls when building a complete implementat
 
 Optionally pass epicRequestId to link this epic to an approved Epic Request.`,
       inputSchema: {
-        name: z21.string().min(1).max(255).describe("Epic name (required)"),
-        team: z21.string().min(1).describe("Team ID, name, or key (required). Use compbox__list_teams to find available teams."),
-        description: z21.string().max(DESCRIPTION_MAX).optional().describe("Epic description"),
-        icon: z21.string().max(50).optional().describe("Icon identifier (e.g., 'rocket', 'star')"),
-        color: z21.string().max(20).optional().describe("Hex color code (e.g., '#FF5733')"),
-        epicRequestId: z21.string().uuid().optional().describe(
+        name: z22.string().min(1).max(255).describe("Epic name (required)"),
+        team: z22.string().min(1).describe("Team ID, name, or key (required). Use compbox__list_teams to find available teams."),
+        description: z22.string().max(DESCRIPTION_MAX).optional().describe("Epic description"),
+        icon: z22.string().max(50).optional().describe("Icon identifier (e.g., 'rocket', 'star')"),
+        color: z22.string().max(20).optional().describe("Hex color code (e.g., '#FF5733')"),
+        epicRequestId: z22.string().uuid().optional().describe(
           "UUID of an Epic Request to link to this epic. When provided without deferConversion, the Epic Request will be marked as converted. With deferConversion: true, conversion is skipped (ER must be in 'planning' status)."
         ),
-        bypassGovernance: z21.boolean().optional(),
-        deferConversion: z21.boolean().optional().describe(
+        bypassGovernance: z22.boolean().optional(),
+        deferConversion: z22.boolean().optional().describe(
           "When true, governance accepts 'planning' status and skips auto-conversion of the Epic Request. Used by the planner pipeline which handles conversion in its final VERIFY stage."
         ),
-        features: z21.array(compositeFeatureSchema).min(1).describe(
+        features: z22.array(compositeFeatureSchema).min(1).describe(
           "Array of features to create. Each feature must have at least 1 task. Features are created in order, so dependencies must reference earlier indices (0-based)."
         )
       }
@@ -10829,19 +10894,19 @@ Optionally pass epicRequestId to link this epic to an approved Epic Request.`,
     {
       description: "Run all validations for a task and mark it complete if all pass.\n\nThis composite tool combines:\n- compbox__run_all_validations\n- compbox__complete_work (if validations pass)\n\nBehavior:\n- Runs all validation checks defined on the task\n- If ALL validations pass, marks the task as complete with the provided summary\n- If ANY validation fails, returns the failure details WITHOUT completing the task\n- If no validations are defined, completes the task immediately\n\nUse this at the end of implementing a task to ensure all acceptance criteria are met before marking it done.",
       inputSchema: {
-        taskId: z21.string().describe(
+        taskId: z22.string().describe(
           "The task identifier. Accepts UUID or human-readable identifier (e.g., 'COM-123-1')."
         ),
-        summary: z21.string().max(5e3).optional().describe(
+        summary: z22.string().max(5e3).optional().describe(
           "Summary of work completed. Will be logged as an AI note when the task is marked complete."
         ),
-        workingDirectory: z21.string().max(1e3).optional().describe(
+        workingDirectory: z22.string().max(1e3).optional().describe(
           "Working directory for running validation commands. Defaults to current working directory."
         ),
-        stopOnFirstFailure: z21.boolean().optional().describe(
+        stopOnFirstFailure: z22.boolean().optional().describe(
           "If true, stops running validations after the first failure. Default is false (run all)."
         ),
-        skipValidations: z21.boolean().optional().describe(
+        skipValidations: z22.boolean().optional().describe(
           "If true, skips running validations and completes the task immediately. Use with caution - only for tasks where validations are not applicable."
         )
       }
@@ -10954,17 +11019,17 @@ Optionally pass epicRequestId to link this epic to an approved Epic Request.`,
 }
 
 // src/tools/workflow.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 function registerWorkflowTools(server2) {
   server2.registerTool(
     "compbox__get_next_required_action",
     {
       description: "Analyze current work item state and suggest the next required action to maintain compliance with CompBox best practices. Returns prioritized list of suggestions with tool names and example parameters.\n\nUse this when you're unsure what to do next with a feature, task, or epic to ensure proper workflow compliance and tracking.",
       inputSchema: {
-        itemId: z22.string().describe(
+        itemId: z23.string().describe(
           "The feature, task, or epic identifier. Accepts UUID or human-readable identifier (e.g., 'COM-123' for features, 'COM-123-1' for tasks). Epics use UUID, identifier (e.g., 'ENG-E1'), or exact name."
         ),
-        itemType: z22.enum(["feature", "task", "epic"]).describe(
+        itemType: z23.enum(["feature", "task", "epic"]).describe(
           "Whether this is a 'feature', 'task', or 'epic'."
         )
       }
@@ -11165,7 +11230,7 @@ function registerWorkflowTools(server2) {
     {
       description: "Get the current state of an AI session and allowed state transitions. The session state machine tracks workflow progress through states: STARTED \u2192 PLANNING \u2192 IMPLEMENTING \u2192 VALIDATING \u2192 COMPLETING.\n\nUse this to understand where you are in the workflow and what transitions are allowed.",
       inputSchema: {
-        sessionId: z22.string().describe(
+        sessionId: z23.string().describe(
           "The session ID to query. Get this from compbox__start_session or compbox__get_active_session."
         )
       }
@@ -11195,17 +11260,17 @@ function registerWorkflowTools(server2) {
 // src/tools/project-flags.ts
 import * as fs from "fs/promises";
 import * as path from "path";
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 function registerProjectFlagTools(server2) {
   server2.registerTool(
     "compbox__mark_docs_audit_complete",
     {
       description: "Mark a project's documentation audit as complete by writing the .compbox/docs-audit.json sentinel file. This creates the .compbox/ directory if needed and writes a JSON file that prevents the Request Formulator from prompting about documentation audits on future invocations. Use this when a user confirms their project is already documented.",
-      inputSchema: z23.object({
-        projectRoot: z23.string().optional().describe(
+      inputSchema: z24.object({
+        projectRoot: z24.string().optional().describe(
           "Project root directory (default: current working directory)"
         ),
-        epicRequestId: z23.string().optional().describe(
+        epicRequestId: z24.string().optional().describe(
           "Optional Epic Request ID if the audit was completed via a CompBox epic request"
         )
       })
@@ -11257,7 +11322,7 @@ function registerProjectFlagTools(server2) {
 }
 
 // src/tools/changelog.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 var entityTypes = ["epic", "feature", "task"];
 function registerChangelogTools(server2) {
   server2.registerTool(
@@ -11265,31 +11330,31 @@ function registerChangelogTools(server2) {
     {
       description: "Query entity change history with formatted output. Returns field-level changes showing what was modified, when, and by whom. Each entry shows 'field: oldValue \u2192 newValue'. Useful for understanding how an entity evolved over time or tracking specific field changes.\n\nUse cases:\n- See all changes to a feature or task\n- Track status changes over time\n- Find who changed a specific field\n- Audit changes within a date range\n- Review epic-wide changes across all features/tasks",
       inputSchema: {
-        entityType: z24.enum(entityTypes).describe(
+        entityType: z25.enum(entityTypes).describe(
           "Type of entity to query (required). 'epic' for epic changes, 'feature' for feature changes, 'task' for task changes."
         ),
-        entityId: z24.string().describe(
+        entityId: z25.string().describe(
           "UUID of the entity to query (required). The specific epic, feature, or task ID."
         ),
-        epicId: z24.string().uuid().optional().describe(
+        epicId: z25.string().uuid().optional().describe(
           "Filter by epic ID (optional). Accepts UUID or identifier (e.g., 'ENG-E1'). When provided, only returns changes for entities within this epic. Useful for narrowing down results in a multi-epic query."
         ),
-        field: z24.string().max(255).optional().describe(
+        field: z25.string().max(255).optional().describe(
           "Filter by specific field name (optional). Examples: 'statusId', 'title', 'assigneeId', 'description'. Only changes to this field will be returned."
         ),
-        changedBy: z24.string().uuid().optional().describe(
+        changedBy: z25.string().uuid().optional().describe(
           "Filter by user ID who made the change (optional). Only returns changes made by this user."
         ),
-        since: z24.string().optional().describe(
+        since: z25.string().optional().describe(
           "Filter changes on or after this date (optional). Accepts ISO-8601 date (e.g., '2024-01-15') or duration (e.g., '-P7D' for last 7 days, '-P1M' for last month)."
         ),
-        until: z24.string().optional().describe(
+        until: z25.string().optional().describe(
           "Filter changes before this date (optional). Accepts ISO-8601 date format."
         ),
-        limit: z24.number().int().min(1).max(100).optional().describe(
+        limit: z25.number().int().min(1).max(100).optional().describe(
           "Maximum number of entries to return (default: 20, max: 100)."
         ),
-        cursor: z24.string().optional().describe(
+        cursor: z25.string().optional().describe(
           "Pagination cursor from a previous response. Pass this to fetch the next page of results."
         )
       }
@@ -11342,7 +11407,7 @@ function registerChangelogTools(server2) {
 }
 
 // src/tools/sessions.ts
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 import * as fs2 from "fs";
 import * as path2 from "path";
 function readLocalManifest() {
@@ -11403,13 +11468,13 @@ function registerSessionTools(server2) {
     {
       description: "Start a new AI session for an epic. Creates a session record, abandons any existing active session, and returns the previous session's handoff data plus epic progress. Call this at the START of any work session to properly track AI activity. Optionally scope the session to a specific feature within the epic by providing featureId.",
       inputSchema: {
-        epicId: z25.string().describe(
+        epicId: z26.string().describe(
           "The epic to start a session for. Accepts epic ID (UUID), identifier (e.g., 'ENG-E1'), or exact epic name."
         ),
-        externalId: z25.string().optional().describe(
+        externalId: z26.string().optional().describe(
           "Optional external session identifier (e.g., from Copilot or another AI tool)."
         ),
-        featureId: z25.string().uuid().optional().describe(
+        featureId: z26.string().uuid().optional().describe(
           "Optional feature ID (UUID) to scope this session to a specific feature within the epic. When provided, the session tracks work on a single feature. Omit for epic-wide sessions (default behavior)."
         )
       }
@@ -11437,19 +11502,19 @@ function registerSessionTools(server2) {
     {
       description: "End the active AI session for an epic with handoff data. Records summary, next steps, blockers, and decisions for the next session. Call this at the END of a work session. If the session was feature-scoped, the response includes featureId indicating which feature was targeted.",
       inputSchema: {
-        epicId: z25.string().describe(
+        epicId: z26.string().describe(
           "The epic whose active session to end. Accepts epic ID (UUID), identifier (e.g., 'ENG-E1'), or exact epic name."
         ),
-        summary: z25.string().describe("Summary of work completed during this session."),
-        nextSteps: z25.array(z25.string()).optional().describe("Recommended next actions for the successor session."),
-        blockers: z25.array(z25.string()).optional().describe("Blockers encountered during this session."),
-        decisions: z25.array(
-          z25.object({
-            decision: z25.string(),
-            rationale: z25.string().optional()
+        summary: z26.string().describe("Summary of work completed during this session."),
+        nextSteps: z26.array(z26.string()).optional().describe("Recommended next actions for the successor session."),
+        blockers: z26.array(z26.string()).optional().describe("Blockers encountered during this session."),
+        decisions: z26.array(
+          z26.object({
+            decision: z26.string(),
+            rationale: z26.string().optional()
           })
         ).optional().describe("Key decisions made during this session with rationale."),
-        contextBlob: z25.string().optional().describe("Optional free-form context blob for the next session.")
+        contextBlob: z26.string().optional().describe("Optional free-form context blob for the next session.")
       }
     },
     async (input) => {
@@ -11473,7 +11538,7 @@ function registerSessionTools(server2) {
     {
       description: "Check if there is an active AI session for an epic. Returns the session if active, or null.",
       inputSchema: {
-        epicId: z25.string().describe(
+        epicId: z26.string().describe(
           "The epic to check. Accepts epic ID (UUID), identifier (e.g., 'ENG-E1'), or exact epic name."
         )
       }
@@ -11493,7 +11558,7 @@ function registerSessionTools(server2) {
     {
       description: "Get the last completed session for an epic. Returns previous session handoff data without starting a new session. Use this to review what happened in the previous session.",
       inputSchema: {
-        epicId: z25.string().describe(
+        epicId: z26.string().describe(
           "The epic to query. Accepts epic ID (UUID), identifier (e.g., 'ENG-E1'), or exact epic name."
         )
       }
@@ -11513,10 +11578,10 @@ function registerSessionTools(server2) {
     {
       description: "Get the history of AI sessions for an epic. Returns past sessions ordered by most recent first.",
       inputSchema: {
-        epicId: z25.string().describe(
+        epicId: z26.string().describe(
           "The epic to query. Accepts epic ID (UUID), identifier (e.g., 'ENG-E1'), or exact epic name."
         ),
-        limit: z25.number().int().min(1).max(100).optional().describe("Maximum number of sessions to return (default: 10, max: 100).")
+        limit: z26.number().int().min(1).max(100).optional().describe("Maximum number of sessions to return (default: 10, max: 100).")
       }
     },
     async (input) => {
@@ -11535,7 +11600,7 @@ function registerSessionTools(server2) {
 }
 
 // src/tools/compliance.ts
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 var TIER_EMOJI = {
   pass: "\u2705",
   advisory: "\u26A0\uFE0F",
@@ -11606,7 +11671,7 @@ function registerComplianceTools(server2) {
     {
       description: "Trigger a compliance audit for an Epic Request. Evaluates the epic request against compliance rules and returns a detailed score with dimension breakdown and issues. The audit result is persisted on the epic request for future reference.",
       inputSchema: {
-        id: z26.string().min(1).describe(
+        id: z27.string().min(1).describe(
           "The epic request to audit. Accepts UUID or identifier (e.g., 'ER-1')."
         )
       }
@@ -11628,7 +11693,7 @@ function registerComplianceTools(server2) {
     {
       description: "Trigger a full compliance audit for an Epic. Evaluates the epic and all its features and tasks against compliance rules. Returns a detailed score with dimension breakdown and issues. The audit result is persisted on the epic for future reference.",
       inputSchema: {
-        id: z26.string().min(1).describe(
+        id: z27.string().min(1).describe(
           "The epic to audit. Accepts UUID, identifier (e.g., 'ENG-E1'), or exact name."
         )
       }
@@ -11665,20 +11730,20 @@ function registerComplianceTools(server2) {
 }
 
 // src/tools/skill-packs/manage.ts
-import { z as z29 } from "zod";
+import { z as z30 } from "zod";
 
 // src/tools/skill-packs/get-manifest.ts
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 function registerGetPackManifestTool(server2) {
   server2.registerTool(
     "compbox__get_pack_manifest",
     {
       description: "Get the detailed manifest for a specific version of a skill pack.\n\nThe manifest describes the pack's contents including:\n- Agents: AI agents included in the pack\n- Skills: Individual skills/capabilities\n- Instructions: Documentation and usage guides\n- Dependencies: Other packs this pack depends on\n\nUse this to understand what a skill pack contains before installing it, or to see the details of an installed pack's current version.",
       inputSchema: {
-        id: z27.string().describe(
+        id: z28.string().describe(
           "Skill pack ID or name (e.g., '@mycompbox/planning' or UUID)"
         ),
-        version: z27.string().optional().describe(
+        version: z28.string().optional().describe(
           "Specific version to get manifest for (e.g., '1.2.3'). If not provided, uses latest stable version."
         )
       }
@@ -11768,7 +11833,7 @@ function registerGetPackManifestTool(server2) {
 }
 
 // src/tools/skill-packs/sync-local.ts
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 import * as fs3 from "fs/promises";
 import * as path3 from "path";
 import { existsSync } from "fs";
@@ -11778,7 +11843,7 @@ function registerSyncLocalPacksTool(server2) {
     {
       description: "Detect drift between local skill pack installations and the registry.\n\nThis tool compares:\n1. .compbox/manifest.json (local installation record)\n2. Actual files in .github/ (agents, skills, instructions, presets)\n3. Database registry (what's officially installed)\n\nReports:\n- **Untracked files**: Files exist locally but not in manifest\n- **Missing files**: Files in manifest but not on filesystem\n- **Registry mismatches**: Local manifest differs from database registry\n- **Version differences**: Installed version vs. available version\n\nUse this to audit local installations and identify cleanup/sync needs.",
       inputSchema: {
-        projectRoot: z28.string().optional().describe(
+        projectRoot: z29.string().optional().describe(
           "Project root directory (default: current working directory). Must contain .compbox/ and .github/ directories."
         )
       }
@@ -11970,21 +12035,21 @@ function registerSkillPackTools(server2) {
     "compbox__manage_skill_packs",
     {
       description: "Manage Skill Packs with action-based routing. This composite tool provides 5 actions:\n\n**list** - List available skill packs from the registry (supports filtering by official/search)\n**get** - Get details about a specific skill pack by ID or name\n**install** - Install a skill pack by ID/name and version\n**update** - Update an installed skill pack to a new version (or 'latest')\n**list_installed** - List all installed skill packs with their status\n\nUse this to discover, install, and manage skill packs during AI sessions.",
-      inputSchema: z29.object({
-        action: z29.enum(["list", "get", "install", "update", "list_installed"]).describe(
+      inputSchema: z30.object({
+        action: z30.enum(["list", "get", "install", "update", "list_installed"]).describe(
           "The action to perform: 'list' (browse registry), 'get' (pack details), 'install', 'update', or 'list_installed' (your installed packs)"
         ),
         // Used by: list, get, install, update
-        id: z29.string().optional().describe("Skill pack ID or name (e.g., '@mycompbox/planning'). Required for get/install/update actions."),
+        id: z30.string().optional().describe("Skill pack ID or name (e.g., '@mycompbox/planning'). Required for get/install/update actions."),
         // Used by: list
-        cursor: z29.string().optional().describe("Pagination cursor from previous response (list action only)"),
-        limit: z29.number().int().min(1).max(100).optional().describe("Maximum results per page, default 20, max 100 (list action only)"),
-        isOfficial: z29.boolean().optional().describe("Filter by official packs (list action only)"),
-        query: z29.string().optional().describe("Search query to filter by name (list action only)"),
+        cursor: z30.string().optional().describe("Pagination cursor from previous response (list action only)"),
+        limit: z30.number().int().min(1).max(100).optional().describe("Maximum results per page, default 20, max 100 (list action only)"),
+        isOfficial: z30.boolean().optional().describe("Filter by official packs (list action only)"),
+        query: z30.string().optional().describe("Search query to filter by name (list action only)"),
         // Used by: get
-        includeVersions: z29.boolean().optional().describe("Include all versions in response (get action only)"),
+        includeVersions: z30.boolean().optional().describe("Include all versions in response (get action only)"),
         // Used by: install, update
-        version: z29.string().optional().describe("Version to install/update to (e.g., '1.2.3' or 'latest'). Required for install/update actions.")
+        version: z30.string().optional().describe("Version to install/update to (e.g., '1.2.3' or 'latest'). Required for install/update actions.")
       })
     },
     async (input) => {
@@ -12270,7 +12335,7 @@ function withLegacyToolCallRewrite(transport) {
 var SERVER_NAME = "compbox-mcp";
 function resolveServerVersion() {
   if (true) {
-    return "1.21.3";
+    return "1.21.5";
   }
   const require2 = createRequire(import.meta.url);
   for (const candidate of ["../package.json", "./package.json"]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycompbox/compbox-mcp",
-  "version": "1.21.3",
+  "version": "1.21.5",
   "description": "CompBox MCP server - Uses HTTP API client (no direct database access)",
   "license": "MIT",
   "type": "module",