@myspec/mcp-server 0.1.2-next.33 → 0.1.2-next.35

package/dist/index.js

@@ -818,6 +818,9 @@ var TokenManager = class {
 var RefreshRejectedError = class extends NeedsLoginError {
 };
 
+// src/platform/client.ts
+import { createHash } from "crypto";
+
 // ../../packages/platform-client/shared/types.ts
 var RETRYABLE_STATUS_CODES = [408, 429, 502, 503, 504];
 
@@ -1126,7 +1129,7 @@ function transformSpecFileResponse(raw) {
   return {
     id: raw.id,
     projectId: raw.project_id,
-    sessionId: raw.session_id,
+    sessionId: raw.session_id ?? null,
     org: raw.org,
     fileType: normalizeFileType(raw.file_type),
     filePath: raw.file_path,
@@ -1337,12 +1340,14 @@ var HttpFileClient = class {
   async initiateUpload(request, jwtToken) {
     const body = {
       project_id: request.projectId,
-      session_id: request.sessionId,
       file_type: request.fileType,
       file_path: request.filePath,
       file_size_bytes: request.fileSizeBytes,
       checksum: request.checksum
     };
+    if (request.sessionId) {
+      body.session_id = request.sessionId;
+    }
     const response = await this.httpClient.post(
       "/project/v1/files/initiate",
       body,
@@ -1830,6 +1835,82 @@ var PlatformClient = class {
       fileUri: uploaded.fileUri
     };
   }
+  /** Creates a new project. */
+  async createProject(request) {
+    return this.withTokenRetry((jwt, c) => c.project.createProject(request, jwt));
+  }
+  /** Updates an existing project's metadata (name, description, status, ...). */
+  async updateProject(projectId, updates) {
+    return this.withTokenRetry((jwt, c) => c.project.updateProject(projectId, updates, jwt));
+  }
+  /** Archives a project by setting its status to `archived`. */
+  async archiveProject(projectId) {
+    return this.updateProject(projectId, { status: "archived" });
+  }
+  /** Unarchives a project by setting its status to `active`. */
+  async unarchiveProject(projectId) {
+    return this.updateProject(projectId, { status: "active" });
+  }
+  /**
+   * Soft-deletes a project. The platform rejects this unless the project is
+   * already archived, surfacing a validation/conflict error the caller reports.
+   */
+  async deleteProject(projectId) {
+    await this.withTokenRetry((jwt, c) => c.project.deleteProject(projectId, jwt));
+  }
+  /**
+   * Two-phase upload of a new, session-less ("unbound") spec file. Reserves a
+   * file id (Phase 1, `sessionId` omitted so the file is unbound), then PUTs
+   * the content (Phase 2). Size and a `sha256:`-prefixed checksum are computed
+   * here from the bytes. Returns the created file's metadata.
+   */
+  async uploadSpecFile(args) {
+    const initiated = await this.withTokenRetry(
+      (jwt, c) => c.file.initiateUpload(
+        {
+          projectId: args.projectId,
+          filePath: args.filePath,
+          fileType: args.fileType,
+          fileSizeBytes: args.content.byteLength,
+          checksum: sha256Prefixed(args.content)
+        },
+        jwt
+      )
+    );
+    await this.withTokenRetry(
+      (jwt, c) => c.file.uploadContent(initiated.fileId, args.content, jwt)
+    );
+    return this.getFileMetadata(initiated.fileId);
+  }
+  /**
+   * Saves a new revision (overwrite) of an existing spec file by id. The
+   * platform computes the checksum server-side. Returns the file's updated
+   * metadata (including the bumped revision count).
+   */
+  async saveSpecFileRevision(fileId, content) {
+    await this.withTokenRetry((jwt, c) => c.file.saveManualRevision(fileId, content, jwt));
+    return this.getFileMetadata(fileId);
+  }
+  /**
+   * Finds a project's spec file by exact file_path, paging through the list.
+   * Returns null when no file matches. Used to enforce create-vs-overwrite
+   * semantics and to resolve a file reference by path.
+   */
+  async findSpecFileByPath(projectId, filePath) {
+    const pageSize = 100;
+    let offset = 0;
+    for (; ; ) {
+      const page = await this.listFiles(projectId, { limit: pageSize, offset });
+      const found = page.files.find((f) => f.filePath === filePath);
+      if (found) {
+        return found;
+      }
+      offset += page.files.length;
+      if (page.files.length < pageSize || offset >= page.total) {
+        return null;
+      }
+    }
+  }
   /**
    * Builds the HTTP clients on first use, resolving the base URL lazily. A
    * successful build is cached for the process lifetime; a failed resolution
@@ -1866,6 +1947,9 @@ var PlatformClient = class {
     }
   }
 };
+function sha256Prefixed(content) {
+  return "sha256:" + createHash("sha256").update(content).digest("hex");
+}
 function statusOf(err) {
   if (typeof err !== "object" || err === null) {
     return void 0;
@@ -1892,16 +1976,91 @@ function errorResult(message) {
   return { content: [{ type: "text", text: message }], isError: true };
 }
 
-// src/server/tools/get_attachment.ts
+// src/server/tools/archive_project.ts
 import { z } from "zod";
+
+// src/server/tools/project-output.ts
+function projectSummary(project) {
+  return {
+    id: project.id,
+    name: project.name,
+    description: project.description,
+    status: project.status,
+    project_type: project.projectType,
+    created_at: project.createdAt,
+    updated_at: project.updatedAt
+  };
+}
+
+// src/server/tools/archive_project.ts
 var inputSchema = {
-  attachment_id: z.string().min(1).describe("UUID of the attachment"),
-  include_download_url: z.number().int().nonnegative().optional().describe("Set to any positive value to include a signed download URL. Omit or 0 to skip.")
+  project_id: z.string().min(1).describe("UUID of the project to archive.")
+};
+var archiveProjectTool = {
+  name: "archive_project",
+  description: 'Archive a project (sets status to "archived"). Idempotent: archiving an already-archived project succeeds.',
+  inputSchema,
+  handler: async (args, ctx) => {
+    const project = await ctx.client.archiveProject(args.project_id);
+    return jsonResult({ project: projectSummary(project) });
+  }
+};
+
+// src/server/tools/create_project.ts
+import { z as z2 } from "zod";
+var inputSchema2 = {
+  name: z2.string().describe("Name of the project to create."),
+  description: z2.string().optional().describe("Optional project description.")
+};
+var createProjectTool = {
+  name: "create_project",
+  description: "Create a new project. Returns the created project id and metadata.",
+  inputSchema: inputSchema2,
+  handler: async (args, ctx) => {
+    const name = args.name.trim();
+    if (name === "") {
+      return errorResult("name is required and cannot be empty.");
+    }
+    const project = await ctx.client.createProject({
+      name,
+      description: args.description
+    });
+    return jsonResult({ project: projectSummary(project) });
+  }
+};
+
+// src/server/tools/delete_project.ts
+import { z as z3 } from "zod";
+var inputSchema3 = {
+  project_id: z3.string().min(1).describe("UUID of the project to delete.")
+};
+var deleteProjectTool = {
+  name: "delete_project",
+  description: "Soft-delete a project. The project must be archived first; deleting a non-archived project is rejected.",
+  inputSchema: inputSchema3,
+  handler: async (args, ctx) => {
+    try {
+      await ctx.client.deleteProject(args.project_id);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return errorResult(
+        `Failed to delete project ${args.project_id}: ${message} (a project must be archived before it can be deleted).`
+      );
+    }
+    return jsonResult({ deleted: true, project_id: args.project_id });
+  }
+};
+
+// src/server/tools/get_attachment.ts
+import { z as z4 } from "zod";
+var inputSchema4 = {
+  attachment_id: z4.string().min(1).describe("UUID of the attachment"),
+  include_download_url: z4.number().int().nonnegative().optional().describe("Set to any positive value to include a signed download URL. Omit or 0 to skip.")
 };
 var getAttachmentTool = {
   name: "get_attachment",
   description: "Get attachment metadata. With `include_download_url>0`, also returns a signed `download_url`.",
-  inputSchema,
+  inputSchema: inputSchema4,
   handler: async (args, ctx) => {
     const attachment = await ctx.client.getAttachmentMetadata(args.attachment_id);
     if (!attachment) {
@@ -1930,17 +2089,17 @@ var getAttachmentTool = {
 };
 
 // src/server/tools/get_file.ts
-import { z as z2 } from "zod";
-var inputSchema2 = {
-  file_id: z2.string().min(1).describe("UUID of the file"),
-  include_download_url: z2.number().int().nonnegative().optional().describe(
+import { z as z5 } from "zod";
+var inputSchema5 = {
+  file_id: z5.string().min(1).describe("UUID of the file"),
+  include_download_url: z5.number().int().nonnegative().optional().describe(
     "Revision number to include a download URL for. Returns a signed, time-limited URL for that revision (latest or historical) that needs no credentials. Omit or 0 to skip."
   )
 };
 var getFileTool = {
   name: "get_file",
   description: "Get file metadata. With `include_download_url=N`, also returns a signed, time-limited download URL for revision N (latest or historical). The URL is self-authenticating, so no credentials are returned.",
-  inputSchema: inputSchema2,
+  inputSchema: inputSchema5,
   handler: async (args, ctx) => {
     const meta = await ctx.client.getFileMetadata(args.file_id);
     const base = {
@@ -1976,14 +2135,14 @@ var getFileTool = {
 };
 
 // src/server/tools/get_project.ts
-import { z as z3 } from "zod";
-var inputSchema3 = {
-  project_id: z3.string().min(1).describe("UUID of the project to fetch")
+import { z as z6 } from "zod";
+var inputSchema6 = {
+  project_id: z6.string().min(1).describe("UUID of the project to fetch")
 };
 var getProjectTool = {
   name: "get_project",
   description: "Get details for a project including all active spec sessions, files (id + metadata), and attachments (id + metadata).",
-  inputSchema: inputSchema3,
+  inputSchema: inputSchema6,
   handler: async (args, ctx) => {
     const [project, sessions, files, attachments] = await Promise.all([
       ctx.client.getProject(args.project_id),
@@ -2029,18 +2188,18 @@ var getProjectTool = {
 };
 
 // src/server/tools/list_projects.ts
-import { z as z4 } from "zod";
-var inputSchema4 = {
-  query: z4.string().optional().describe(
+import { z as z7 } from "zod";
+var inputSchema7 = {
+  query: z7.string().optional().describe(
     "Search term to filter projects by name. Omit to list all projects."
   ),
-  limit: z4.number().int().positive().max(100).optional().describe("Max projects to return (default 20)"),
-  offset: z4.number().int().nonnegative().optional().describe("Pagination offset (default 0)")
+  limit: z7.number().int().positive().max(100).optional().describe("Max projects to return (default 20)"),
+  offset: z7.number().int().nonnegative().optional().describe("Pagination offset (default 0)")
 };
 var listProjectsTool = {
   name: "list_projects",
   description: "List or search MySpec projects accessible to the authenticated user.",
-  inputSchema: inputSchema4,
+  inputSchema: inputSchema7,
   handler: async (args, ctx) => {
     const result = await ctx.client.listProjects({
       query: args.query,
@@ -2066,7 +2225,7 @@ var listProjectsTool = {
 import { promises as fs3 } from "fs";
 import os3 from "os";
 import path3 from "path";
-import { z as z5 } from "zod";
+import { z as z8 } from "zod";
 
 // src/server/download-path.ts
 import { promises as fs2 } from "fs";
@@ -2133,14 +2292,14 @@ async function writeBytesAtomically(target, bytes) {
 
 // src/server/tools/read_file.ts
 var MAX_READ_BYTES = 1 * 1024 * 1024;
-var inputSchema5 = {
-  file_id: z5.string().min(1).describe("UUID of the file"),
-  revision: z5.number().int().positive().optional().describe("Specific revision number to read (defaults to the latest revision).")
+var inputSchema8 = {
+  file_id: z8.string().min(1).describe("UUID of the file"),
+  revision: z8.number().int().positive().optional().describe("Specific revision number to read (defaults to the latest revision).")
 };
 var readFileTool = {
   name: "read_file",
   description: "Return a file's UTF-8 content. Bytes are cached on disk under the configured cache root (default ~/.myspec) at `project/<projectId>/file/<fileId>/rev/<rev>/<basename>` and reused on subsequent reads of the same revision. Fails for binary files or files larger than 1 MiB \u2014 use get_file with `include_download_url` to obtain a download URL for those.",
-  inputSchema: inputSchema5,
+  inputSchema: inputSchema8,
   handler: async (args, ctx) => {
     const meta = await ctx.client.getFileMetadata(args.file_id);
     const targetRevision = args.revision ?? meta.revisionCount;
@@ -2225,11 +2384,104 @@ function isBinary(bytes) {
   return false;
 }
 
+// src/server/tools/unarchive_project.ts
+import { z as z9 } from "zod";
+var inputSchema9 = {
+  project_id: z9.string().min(1).describe("UUID of the project to unarchive.")
+};
+var unarchiveProjectTool = {
+  name: "unarchive_project",
+  description: 'Unarchive a project (sets status to "active"). Idempotent: unarchiving an already-active project succeeds.',
+  inputSchema: inputSchema9,
+  handler: async (args, ctx) => {
+    const project = await ctx.client.unarchiveProject(args.project_id);
+    return jsonResult({ project: projectSummary(project) });
+  }
+};
+
+// src/server/tools/update_project.ts
+import { z as z10 } from "zod";
+var inputSchema10 = {
+  project_id: z10.string().min(1).describe("UUID of the project to update."),
+  name: z10.string().optional().describe("New project name."),
+  description: z10.string().optional().describe("New project description.")
+};
+var updateProjectTool = {
+  name: "update_project",
+  description: "Update a project's metadata (name, description). Returns the updated metadata.",
+  inputSchema: inputSchema10,
+  handler: async (args, ctx) => {
+    if (args.name === void 0 && args.description === void 0) {
+      return errorResult("Provide at least one field to update (name or description).");
+    }
+    const project = await ctx.client.updateProject(args.project_id, {
+      name: args.name,
+      description: args.description
+    });
+    return jsonResult({ project: projectSummary(project) });
+  }
+};
+
+// src/server/tools/update_spec_file.ts
+import { z as z11 } from "zod";
+
+// src/server/tools/spec-file-output.ts
+function specFileSummary(file) {
+  return {
+    id: file.id,
+    project_id: file.projectId,
+    session_id: file.sessionId,
+    file_path: file.filePath,
+    file_type: file.fileType,
+    file_size_bytes: file.fileSizeBytes,
+    checksum: file.checksum,
+    revision_count: file.revisionCount,
+    created_at: file.createdAt,
+    updated_at: file.updatedAt
+  };
+}
+
+// src/server/tools/update_spec_file.ts
+var inputSchema11 = {
+  file_id: z11.string().min(1).optional().describe("UUID of the spec file to overwrite. Provide this or (project_id + file_path)."),
+  project_id: z11.string().min(1).optional().describe("UUID of the project. Required (with file_path) when file_id is not given."),
+  file_path: z11.string().min(1).optional().describe("Path of the spec file. Required (with project_id) when file_id is not given."),
+  content: z11.string().min(1).describe("Full UTF-8 replacement content (non-empty), saved as a new revision.")
+};
+var updateSpecFileTool = {
+  name: "update_spec_file",
+  description: "Overwrite an existing spec file by saving a new revision from full content. Reference the file by file_id or by (project_id + file_path).",
+  inputSchema: inputSchema11,
+  handler: async (args, ctx) => {
+    let fileId;
+    if (args.file_id) {
+      const meta = await ctx.client.getFileMetadata(args.file_id).catch(() => null);
+      if (!meta) {
+        return errorResult(`No spec file found with id ${args.file_id}.`);
+      }
+      fileId = meta.id;
+    } else if (args.project_id && args.file_path) {
+      const match = await ctx.client.findSpecFileByPath(args.project_id, args.file_path);
+      if (!match) {
+        return errorResult(
+          `No spec file found at ${args.file_path} in project ${args.project_id}.`
+        );
+      }
+      fileId = match.id;
+    } else {
+      return errorResult("Provide either file_id, or both project_id and file_path.");
+    }
+    const content = new TextEncoder().encode(args.content);
+    const file = await ctx.client.saveSpecFileRevision(fileId, content);
+    return jsonResult({ file: specFileSummary(file) });
+  }
+};
+
 // src/server/tools/upload_attachment.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { lstat, readFile } from "fs/promises";
 import { basename, extname, isAbsolute } from "path";
-import { z as z6 } from "zod";
+import { z as z12 } from "zod";
 var DEFAULT_MIME = "application/octet-stream";
 var MAX_ATTACHMENT_MB = MAX_ATTACHMENT_BYTES / (1024 * 1024);
 var STRUCTURED_EXTENSION_MIME = {
@@ -2329,23 +2581,23 @@ function inferMimeFromName(name) {
   }
   return DEFAULT_MIME;
 }
-var inputSchema6 = {
-  project_id: z6.string().min(1).describe("UUID of the project to attach the file to."),
-  file_path: z6.string().min(1).describe(
+var inputSchema12 = {
+  project_id: z12.string().min(1).describe("UUID of the project to attach the file to."),
+  file_path: z12.string().min(1).describe(
     "Absolute path to the local file to upload. The MCP server reads this path from its own host."
   ),
-  file_name: z6.string().min(1).optional().describe("Override the filename recorded on the attachment. Defaults to the path basename."),
-  mime_type: z6.string().min(1).optional().describe(
+  file_name: z12.string().min(1).optional().describe("Override the filename recorded on the attachment. Defaults to the path basename."),
+  mime_type: z12.string().min(1).optional().describe(
     "Override the MIME type sent to the platform. The platform re-detects from content, so this is only a hint. If omitted, inferred from the file extension \u2014 structured (.pdf, .docx, .xlsx) keep their canonical MIME; common UTF-8 text formats (.xml, .json, .yaml, .html, .csv, .md, source code, ...) are sent as text/plain."
   ),
-  override: z6.boolean().optional().describe(
+  override: z12.boolean().optional().describe(
     "When true, any existing (non-deleted) attachment on the project whose recorded filename exactly matches `file_name` (or the path basename) is soft-deleted before the new upload, so the new attachment keeps the original name instead of getting an auto-dedup `(1)` suffix. The platform has no in-place content-replace API, so the new upload always gets a new `attachment_id`; any replaced ids are returned as `overridden_attachment_ids` (array, possibly empty) so callers can refresh stored references. Defaults to false (let the platform auto-dedup)."
   )
 };
 var uploadAttachmentTool = {
   name: "upload_attachment",
   description: `Upload a local file as a new attachment on a project. Reads \`file_path\` from the host running the MCP server, computes its SHA256, then performs the two-phase platform upload. Max ${String(MAX_ATTACHMENT_MB)} MB. Supported content: PDF, DOCX, XLSX, and any UTF-8 text file (XML, JSON, YAML, HTML, Markdown, CSV, source code, ...). Binary files outside the structured types will be rejected by the platform.`,
-  inputSchema: inputSchema6,
+  inputSchema: inputSchema12,
   handler: async (args, ctx) => {
     if (!isAbsolute(args.file_path)) {
       return errorResult(`file_path must be an absolute path; got "${args.file_path}".`);
@@ -2402,7 +2654,7 @@ var uploadAttachmentTool = {
     }
     const fileName = args.file_name ?? basename(args.file_path);
     const mimeType = args.mime_type ?? inferMimeFromName(fileName);
-    const checksum = `sha256:${createHash("sha256").update(buf).digest("hex")}`;
+    const checksum = `sha256:${createHash2("sha256").update(buf).digest("hex")}`;
     const bytes = new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
     const existing = await ctx.client.listAttachments(args.project_id);
     const nameMatches = existing.filter((a) => a.name === fileName);
@@ -2468,6 +2720,94 @@ var uploadAttachmentTool = {
   }
 };
 
+// src/server/tools/upload_spec_file.ts
+import { z as z13 } from "zod";
+
+// src/server/spec-path.ts
+var MAX_SPEC_DIR_DEPTH = 3;
+function validateSpecFilePath(filePath) {
+  if (!filePath) {
+    return "file_path is required.";
+  }
+  if (filePath.startsWith("/")) {
+    return "file_path must be a relative path, not an absolute path.";
+  }
+  const segments = filePath.split("/");
+  if (segments.some((s) => s === "..")) {
+    return "file_path must not contain '..' (parent directory) segments.";
+  }
+  if (segments.some((s) => s === "" || s === ".")) {
+    return 'file_path must be a normalized path (no empty, "." or trailing-slash segments).';
+  }
+  if (segments[0] !== "specs") {
+    return "file_path must be rooted at 'specs' (e.g. specs/changes/add-oauth-login/proposal.md).";
+  }
+  if (segments.length < 2) {
+    return "file_path must include a filename under 'specs' (e.g. specs/proposal.md).";
+  }
+  const dirLevels = segments.length - 2;
+  if (dirLevels > MAX_SPEC_DIR_DEPTH) {
+    return `file_path must not nest deeper than ${String(MAX_SPEC_DIR_DEPTH)} directory levels below specs.`;
+  }
+  return null;
+}
+var FILE_TYPE_BY_BASENAME = {
+  constitution: "constitution",
+  requirements: "requirements",
+  solution: "solution",
+  tasks: "tasks",
+  proposal: "proposal"
+};
+function deriveFileType(filePath) {
+  const filename = filePath.split("/").pop() ?? "";
+  const base = filename.replace(/\.[^.]+$/, "").toLowerCase();
+  return FILE_TYPE_BY_BASENAME[base] ?? "openspec-spec";
+}
+
+// src/server/tools/upload_spec_file.ts
+var SPEC_FILE_TYPES = [
+  "constitution",
+  "requirements",
+  "solution",
+  "tasks",
+  "proposal",
+  "openspec-spec"
+];
+var inputSchema13 = {
+  project_id: z13.string().min(1).describe("UUID of the project to upload the file into."),
+  file_path: z13.string().min(1).describe(
+    'Path of the new spec file, rooted at "specs" with at most 3 directory levels below specs (e.g. specs/changes/add-oauth-login/proposal.md).'
+  ),
+  content: z13.string().min(1).describe("Full UTF-8 text content of the spec file (non-empty)."),
+  file_type: z13.enum(SPEC_FILE_TYPES).optional().describe("Spec file type. Omit to derive from the filename (e.g. proposal.md \u2192 proposal).")
+};
+var uploadSpecFileTool = {
+  name: "upload_spec_file",
+  description: "Upload a new, session-less spec file into a project from full content. Rejects if a file already exists at the same path (use update_spec_file to overwrite).",
+  inputSchema: inputSchema13,
+  handler: async (args, ctx) => {
+    const pathError = validateSpecFilePath(args.file_path);
+    if (pathError) {
+      return errorResult(pathError);
+    }
+    const existing = await ctx.client.findSpecFileByPath(args.project_id, args.file_path);
+    if (existing) {
+      return errorResult(
+        `A spec file already exists at ${args.file_path} in project ${args.project_id}. Use update_spec_file to overwrite it.`
+      );
+    }
+    const fileType = args.file_type ?? deriveFileType(args.file_path);
+    const content = new TextEncoder().encode(args.content);
+    const file = await ctx.client.uploadSpecFile({
+      projectId: args.project_id,
+      filePath: args.file_path,
+      fileType,
+      content
+    });
+    return jsonResult({ file: specFileSummary(file) });
+  }
+};
+
 // src/server/server.ts
 function buildServer(deps) {
   const server = new McpServer({
@@ -2480,6 +2820,13 @@ function buildServer(deps) {
   registerTool(server, readFileTool, deps.client);
   registerTool(server, getAttachmentTool, deps.client);
   registerTool(server, uploadAttachmentTool, deps.client);
+  registerTool(server, createProjectTool, deps.client);
+  registerTool(server, updateProjectTool, deps.client);
+  registerTool(server, archiveProjectTool, deps.client);
+  registerTool(server, unarchiveProjectTool, deps.client);
+  registerTool(server, deleteProjectTool, deps.client);
+  registerTool(server, uploadSpecFileTool, deps.client);
+  registerTool(server, updateSpecFileTool, deps.client);
   return server;
 }
 async function startStdioServer(deps) {
@@ -2633,7 +2980,7 @@ async function canonicaliseRoot(root) {
 import { promises as fs4 } from "fs";
 import { join as join2, relative } from "path";
 import { spawn } from "child_process";
-import { z as z7 } from "zod";
+import { z as z14 } from "zod";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 
 // src/reverse/ignore.ts
@@ -2712,7 +3059,7 @@ function ripgrepIgnoreGlobs() {
 }
 
 // src/reverse/pack-codebase.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { mkdtemp, readFile as readFile2, rm } from "fs/promises";
 import { tmpdir } from "os";
 import { join } from "path";
@@ -2783,7 +3130,7 @@ function computeOutputId(inputs) {
     i: inputs.includePatterns ?? "",
     x: inputs.ignorePatterns ?? ""
   });
-  const digest = createHash2("sha256").update(payload).digest("hex").slice(0, 12);
+  const digest = createHash3("sha256").update(payload).digest("hex").slice(0, 12);
   return `pack-${digest}`;
 }
 function readPage(cache, outputId, page) {
@@ -2883,37 +3230,37 @@ var READ_FILE_MAX_LINES = 2e3;
 var LIST_DIR_HARD_CAP = 5e3;
 var LIST_DIR_DEFAULT_CAP = 1e3;
 var GREP_MAX_MATCHES_DEFAULT = 200;
-var listDirInput = z7.object({
-  path: z7.string(),
-  recursive: z7.boolean().optional(),
-  maxEntries: z7.number().int().positive().optional(),
-  includeIgnored: z7.boolean().optional()
+var listDirInput = z14.object({
+  path: z14.string(),
+  recursive: z14.boolean().optional(),
+  maxEntries: z14.number().int().positive().optional(),
+  includeIgnored: z14.boolean().optional()
 });
-var readFileInput = z7.object({
-  path: z7.string(),
-  offset: z7.number().int().nonnegative().optional(),
-  limit: z7.number().int().positive().optional(),
-  includeIgnored: z7.boolean().optional()
+var readFileInput = z14.object({
+  path: z14.string(),
+  offset: z14.number().int().nonnegative().optional(),
+  limit: z14.number().int().positive().optional(),
+  includeIgnored: z14.boolean().optional()
 });
-var grepInput = z7.object({
-  pattern: z7.string().describe(
+var grepInput = z14.object({
+  pattern: z14.string().describe(
     "Search pattern. Interpreted as a regular expression by default (ripgrep syntax), e.g. `foo|bar` or `[Rr]ole`. Set `isRegex: false` to match the pattern as an exact literal string instead."
   ),
-  path: z7.string().optional().describe("File or directory under --root to search. Defaults to the whole root."),
-  isRegex: z7.boolean().optional().describe("Treat `pattern` as a regex (default true). Set false for literal-string search."),
-  caseSensitive: z7.boolean().optional(),
-  maxMatches: z7.number().int().positive().optional(),
-  contextLines: z7.number().int().nonnegative().optional(),
-  includeIgnored: z7.boolean().optional()
+  path: z14.string().optional().describe("File or directory under --root to search. Defaults to the whole root."),
+  isRegex: z14.boolean().optional().describe("Treat `pattern` as a regex (default true). Set false for literal-string search."),
+  caseSensitive: z14.boolean().optional(),
+  maxMatches: z14.number().int().positive().optional(),
+  contextLines: z14.number().int().nonnegative().optional(),
+  includeIgnored: z14.boolean().optional()
 });
-var packCodebaseInput = z7.object({
-  subpath: z7.string().optional(),
-  includePatterns: z7.string().optional(),
-  ignorePatterns: z7.string().optional()
+var packCodebaseInput = z14.object({
+  subpath: z14.string().optional(),
+  includePatterns: z14.string().optional(),
+  ignorePatterns: z14.string().optional()
 });
-var packCodebaseReadPageInput = z7.object({
-  outputId: z7.string(),
-  page: z7.number().int().positive()
+var packCodebaseReadPageInput = z14.object({
+  outputId: z14.string(),
+  page: z14.number().int().positive()
 });
 function structuredError(error, message, extra) {
   const payload = { error, message, ...extra ?? {} };
@@ -3441,7 +3788,7 @@ function jsonSchemaFromZod(schema) {
   return zodToJson(schema);
 }
 function zodToJson(schema) {
-  if (schema instanceof z7.ZodObject) {
+  if (schema instanceof z14.ZodObject) {
     const shape = schema.shape;
     const properties = {};
     const required = [];
@@ -3456,19 +3803,19 @@ function zodToJson(schema) {
     if (required.length > 0) out.required = required;
     return out;
   }
-  if (schema instanceof z7.ZodOptional) {
+  if (schema instanceof z14.ZodOptional) {
     return zodToJson(schema.unwrap());
   }
-  if (schema instanceof z7.ZodString) {
+  if (schema instanceof z14.ZodString) {
     return { type: "string" };
   }
-  if (schema instanceof z7.ZodNumber) {
+  if (schema instanceof z14.ZodNumber) {
     return { type: "number" };
   }
-  if (schema instanceof z7.ZodBoolean) {
+  if (schema instanceof z14.ZodBoolean) {
     return { type: "boolean" };
   }
-  if (schema instanceof z7.ZodEnum) {
+  if (schema instanceof z14.ZodEnum) {
     return { type: "string", enum: schema.options };
   }
   return { type: "string" };
@@ -3487,8 +3834,7 @@ async function runReverse(opts) {
   const realRoot = await canonicaliseRoot(opts.root);
   const rootLabel = basename3(realRoot);
   process.stderr.write(
-    `myspec-mcp reverse: granting read access to ${realRoot} | agent: ${opts.agentUrl}
-Press Ctrl-C to stop. Auto-reconnect enabled.
+    `myspec-mcp reverse: granting read access to ${realRoot}Press Ctrl-C to stop. Auto-reconnect enabled.
 `
   );
   let backoffMs = RECONNECT_BACKOFF_INITIAL_MS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myspec/mcp-server",
-  "version": "0.1.2-next.33",
+  "version": "0.1.2-next.35",
   "description": "MySpec MCP server — exposes MySpec platform projects, files and attachments to MCP-aware clients via OAuth-authenticated access tokens.",
   "type": "module",
   "repository": {