@myspec/mcp-server 1.1.1-next.176 → 1.1.2-next.178

package/README.md

@@ -339,6 +339,7 @@ Local state is stored under `~/.myspec/` (alongside the on-disk cache root), spl
 | `read_spec_file` | `file_id`, optional `revision`, optional `offset`, optional `limit` | UTF-8 content paginated by line (`offset` is 1-based, default/cap 2000 lines, 1 MiB per response) with `content`, `start_line`, `end_line`, `read_lines`, `total_lines`, `truncated`, `next_offset`; plus `content_version` when reading the latest revision (errors for binary or files > 8 MiB — use `download_spec_file` for those). Cached on disk under `MYSPEC_DOWNLOAD_ROOT`, so paging through a file downloads it once |
 | `download_spec_file` | `file_id`, optional `destination_path`, optional `revision`, optional `overwrite` | Downloads the file's raw bytes to a local file — by default under `.specs/` in the working directory (see [Download destinations](#download-destinations)). Handles binary files and files up to 50 MiB. Refuses to replace an existing file unless `overwrite=true`. Returns only metadata (`saved_path`, `bytes_written`, `revision_number`, `destination_source`) — **not** the content, so a large file can be saved locally and read in chunks |
 | `list_spec_file` | `project_id`, optional `path`, optional `trashed`, optional `limit`, optional `offset` | Lists a project's spec files (`file_id`, `file_path`, `file_type`, `file_size_bytes`, `revision_count`, `session_id`, `updated_at`, plus `trashed_at` on Trash Bin entries). Filter to a directory with `path` (exact file or everything under it; `""`/`"/"`/omit = all). `trashed=true` lists the Trash Bin instead of live files. Returns `total`, `limit`, `offset` and, when more records remain, `next_offset` (default 50, capped at 200). Ordered by `file_path` when `path` or `trashed` is given, most-recently-created first otherwise |
+| `move_spec_folder` | `project_id`, `from_path`, `to_path` | Moves or renames a folder under `specs/` (a bundle, or a group folder holding bundles) with everything in it, e.g. `specs/mcp` → `specs/archive/mcp`. A bundle's files always move together; ids and contents stay, only paths change |
 | `move_spec_file_to_trash` | `file_id` | Moves a spec file to the Trash Bin (recoverable — hidden from listings and AI-agent tools, restorable indefinitely). Not a permanent delete |
 | `restore_spec_file_from_trash` | `file_id` | Restores a trashed spec file back to the active file list, reversing `move_spec_file_to_trash` |
 | `get_attachment` | `attachment_id`, optional `include_download_url` | Attachment metadata (looked up org-scoped by id); with `include_download_url>0` also returns a signed download URL |

package/dist/index.js

@@ -2335,6 +2335,24 @@ function transformFileListResult(raw) {
   };
 }
 
+// ../../packages/platform-client/project/types/bundle.types.ts
+function transformBundleResponse(raw) {
+  return {
+    name: raw.name,
+    sourceSessionId: raw.source_session_id,
+    status: raw.status,
+    completedAt: raw.completed_at ? new Date(raw.completed_at) : void 0,
+    files: raw.files.map(transformSpecFileResponse)
+  };
+}
+function transformSpecFolderMoveResponse(raw) {
+  return {
+    fromPath: raw.from_path,
+    toPath: raw.to_path,
+    files: raw.files.map(transformSpecFileResponse)
+  };
+}
+
 // ../../packages/platform-client/project/types/project.types.ts
 function toProjectType(raw) {
   return raw === "greenfield" || raw === "brownfield" ? raw : void 0;
@@ -2814,6 +2832,40 @@ var HttpAttachmentClient = class {
   }
 };
 
+// ../../packages/platform-client/project/http/bundle.http-client.ts
+var HttpBundleClient = class {
+  httpClient;
+  constructor(httpClient) {
+    this.httpClient = httpClient;
+  }
+  async listBundles(projectId, jwtToken, opts) {
+    const queryParams = new URLSearchParams();
+    if (opts?.status) queryParams.set("status", opts.status);
+    const query = queryParams.toString();
+    const path4 = query ? `/project/v1/projects/${projectId}/bundles?${query}` : `/project/v1/projects/${projectId}/bundles`;
+    const raw = await this.httpClient.get(path4, jwtToken, {});
+    return raw.bundles.map(transformBundleResponse);
+  }
+  async renameBundle(projectId, req, jwtToken) {
+    const raw = await this.httpClient.post(
+      `/project/v1/projects/${projectId}/renameBundle`,
+      { old_name: req.oldName, new_name: req.newName },
+      jwtToken,
+      {}
+    );
+    return transformBundleResponse(raw);
+  }
+  async moveSpecFolder(projectId, req, jwtToken) {
+    const raw = await this.httpClient.post(
+      `/project/v1/projects/${projectId}/moveSpecFolder`,
+      { from_path: req.fromPath, to_path: req.toPath },
+      jwtToken,
+      {}
+    );
+    return transformSpecFolderMoveResponse(raw);
+  }
+};
+
 // ../../packages/platform-client/project/http/file.http-client.ts
 var HEADER_EXPECTED_VERSION = "X-Expected-Version";
 var HEADER_ACTOR_KIND = "X-Actor-Kind";
@@ -4086,6 +4138,16 @@ var PlatformClient = class {
   async trashFile(fileId) {
     await this.withTokenRetry((jwt, c) => c.file.trashFile(fileId, jwt, { actorKind: "ai" }));
   }
+  /**
+   * Moves a folder under `specs/` (a bundle, or a group folder holding
+   * bundles) and everything in it to a new path. Paths include the `specs/`
+   * root. Only file paths change: ids, contents and storage stay put.
+   */
+  async moveSpecFolder(projectId, fromPath, toPath) {
+    return this.withTokenRetry(
+      (jwt, c) => c.bundle.moveSpecFolder(projectId, { fromPath, toPath }, jwt)
+    );
+  }
   /** Restores a spec file from the Trash Bin back to the active file list. */
   async restoreFile(fileId) {
     await this.withTokenRetry((jwt, c) => c.file.restoreFile(fileId, jwt));
@@ -4186,6 +4248,7 @@ var PlatformClient = class {
     const httpClient = new BaseHttpClient({ baseUrl, logger: silentLogger });
     return {
       project: new HttpProjectClient(httpClient),
+      bundle: new HttpBundleClient(httpClient),
       session: new HttpSpecSessionClient(httpClient),
       file: new HttpFileClient(httpClient),
       attachment: new HttpAttachmentClient(httpClient),
@@ -5336,9 +5399,114 @@ var moveSpecFileToTrashTool = {
   }
 };
 
-// src/server/tools/read_attachment.ts
+// src/server/tools/move_spec_folder.ts
 import { z as z16 } from "zod";
 
+// src/server/spec-path.ts
+var MAX_SPEC_DIR_DEPTH = 3;
+function validateSpecFilePath(filePath) {
+  if (!filePath) {
+    return "file_path is required.";
+  }
+  if (filePath.startsWith("/")) {
+    return "file_path must be a relative path, not an absolute path.";
+  }
+  const segments = filePath.split("/");
+  if (segments.some((s) => s === "..")) {
+    return "file_path must not contain '..' (parent directory) segments.";
+  }
+  if (segments.some((s) => s === "" || s === ".")) {
+    return 'file_path must be a normalized path (no empty, "." or trailing-slash segments).';
+  }
+  const root = segments[0];
+  if (root !== "specs" && root !== "openspec") {
+    return "file_path must be rooted at 'specs' or 'openspec' (e.g. specs/changes/add-oauth-login/proposal.md).";
+  }
+  if (segments.length < 2) {
+    return `file_path must include a filename under '${root}' (e.g. ${root}/proposal.md).`;
+  }
+  const dirLevels = segments.length - 2;
+  if (dirLevels > MAX_SPEC_DIR_DEPTH) {
+    return `file_path must not nest deeper than ${String(MAX_SPEC_DIR_DEPTH)} directory levels below the '${root}' root.`;
+  }
+  return null;
+}
+function validateSpecFolderPath(field, folderPath) {
+  const path4 = folderPath.endsWith("/") ? folderPath.slice(0, -1) : folderPath;
+  if (!path4) {
+    return { error: `${field} is required.` };
+  }
+  if (path4.startsWith("/")) {
+    return { error: `${field} must be a relative path, not an absolute path.` };
+  }
+  const segments = path4.split("/");
+  if (segments.some((s) => s === "..")) {
+    return { error: `${field} must not contain '..' (parent directory) segments.` };
+  }
+  if (segments.some((s) => s === "" || s === ".")) {
+    return { error: `${field} must be a normalized path (no empty or "." segments).` };
+  }
+  if (segments[0] === "openspec") {
+    return {
+      error: `${field}: OpenSpec folders cannot be moved; the OpenSpec CLI relies on the change id.`
+    };
+  }
+  if (segments[0] !== "specs" || segments.length < 2) {
+    return { error: `${field} must be a folder under specs/ (e.g. specs/group/my-bundle).` };
+  }
+  if (segments.length - 1 > MAX_SPEC_DIR_DEPTH) {
+    return {
+      error: `${field} must not nest deeper than ${String(MAX_SPEC_DIR_DEPTH)} directory levels below 'specs'.`
+    };
+  }
+  return { path: path4 };
+}
+var FILE_TYPE_BY_BASENAME = {
+  constitution: "constitution",
+  requirements: "requirements",
+  solution: "solution",
+  tasks: "tasks",
+  // Enterprise greenfield quality plan (generate-greenfield-enterprise).
+  quality: "quality",
+  proposal: "proposal"
+};
+function deriveFileType(filePath) {
+  const filename = filePath.split("/").pop() ?? "";
+  const base = filename.replace(/\.[^.]+$/, "").toLowerCase();
+  return FILE_TYPE_BY_BASENAME[base] ?? "openspec-spec";
+}
+
+// src/server/tools/move_spec_folder.ts
+var inputSchema16 = {
+  project_id: z16.string().min(1).describe("UUID of the project holding the folder."),
+  from_path: z16.string().min(1).describe('Folder to move, under "specs" (e.g. specs/mcp or specs/mcp/my-bundle).'),
+  to_path: z16.string().min(1).describe(
+    'New folder path: "specs" plus 1-3 lowercase kebab-case segments (e.g. specs/archive/mcp). Under the same parent, this renames the folder.'
+  )
+};
+var moveSpecFolderTool = {
+  name: "move_spec_folder",
+  description: "Move or rename a folder under specs/ together with everything in it. The folder can be a bundle (it holds spec files directly) or a group folder holding bundles. The files of a bundle always move together; single files cannot be moved out of a bundle. File ids, contents and revisions stay the same; only paths change, so address the files by their new paths afterwards. Refused: OpenSpec folders, specs/memory, a target inside the folder itself, a target that already exists (Trash included) or sits inside a bundle, a folder inside a bundle (move the bundle instead), a folder whose bundle is still generating, and a move that would nest a bundle more than 3 levels below specs/.",
+  inputSchema: inputSchema16,
+  handler: async (args, ctx) => {
+    const from = validateSpecFolderPath("from_path", args.from_path);
+    if (from.error !== void 0) return errorResult(from.error);
+    const to = validateSpecFolderPath("to_path", args.to_path);
+    if (to.error !== void 0) return errorResult(to.error);
+    const moved = await ctx.client.moveSpecFolder(args.project_id, from.path, to.path);
+    return jsonResult({
+      moved: true,
+      from_path: moved.fromPath,
+      to_path: moved.toPath,
+      file_count: moved.files.length,
+      files: moved.files.map((f) => ({ id: f.id, file_path: f.filePath }))
+    });
+  }
+};
+
+// src/server/tools/read_attachment.ts
+import { z as z17 } from "zod";
+
 // src/util/paginate-lines.ts
 var MAX_LINES_PER_CALL = 2e3;
 var MAX_RESPONSE_BYTES = 1 * 1024 * 1024;
@@ -5449,17 +5617,17 @@ var TEXT_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/svg+xml"
 ]);
 var GENERIC_MIME_TYPES = /* @__PURE__ */ new Set(["application/octet-stream", ""]);
-var inputSchema16 = {
-  attachment_id: z16.string().min(1).describe("UUID of the attachment to read"),
-  offset: z16.number().int().nonnegative().optional().describe(
+var inputSchema17 = {
+  attachment_id: z17.string().min(1).describe("UUID of the attachment to read"),
+  offset: z17.number().int().nonnegative().optional().describe(
     "1-based line number to start reading from (text attachments only; default 1; 0 is an alias for 1)."
   ),
-  limit: z16.number().int().positive().optional().describe("Max lines to return (text attachments only; default 2000, capped at 2000).")
+  limit: z17.number().int().positive().optional().describe("Max lines to return (text attachments only; default 2000, capped at 2000).")
 };
 var readAttachmentTool = {
   name: "read_attachment",
   description: `Return an attachment's content inline. UTF-8 text is paginated by line (offset/limit, 1 MiB per response). Images (png, jpeg, gif, webp) are returned whole as an MCP image block \u2014 never paginated \u2014 up to the ${String(MAX_ATTACHMENT_MB)} MiB attachment limit; a 10 MiB image is roughly 13.4 MiB of base64, so check file_size_bytes (from get_attachment or list_attachments) before reading a large one. Other binary types (pdf, docx, xlsx, \u2026) cannot be read here; view them in the MySpec webapp.`,
-  inputSchema: inputSchema16,
+  inputSchema: inputSchema17,
   handler: async (args, ctx) => {
     const meta = await ctx.client.getAttachmentMetadata(args.attachment_id);
     if (!meta) {
@@ -5516,18 +5684,18 @@ var readAttachmentTool = {
 // src/server/tools/read_spec_file.ts
 import { promises as fs3 } from "fs";
 import { createHash as createHash2 } from "crypto";
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var MAX_READABLE_SPEC_FILE_BYTES = 8 * 1024 * 1024;
-var inputSchema17 = {
-  file_id: z17.string().min(1).describe("UUID of the file"),
-  revision: z17.number().int().positive().optional().describe("Specific revision number to read (defaults to the latest revision)."),
-  offset: z17.number().int().nonnegative().optional().describe("1-based line number to start reading from (default 1; 0 is an alias for 1)."),
-  limit: z17.number().int().positive().optional().describe("Max lines to return (default 2000, capped at 2000; larger values are clamped).")
+var inputSchema18 = {
+  file_id: z18.string().min(1).describe("UUID of the file"),
+  revision: z18.number().int().positive().optional().describe("Specific revision number to read (defaults to the latest revision)."),
+  offset: z18.number().int().nonnegative().optional().describe("1-based line number to start reading from (default 1; 0 is an alias for 1)."),
+  limit: z18.number().int().positive().optional().describe("Max lines to return (default 2000, capped at 2000; larger values are clamped).")
 };
 var readSpecFileTool = {
   name: "read_spec_file",
   description: "Return a window of a spec file's UTF-8 content, paginated by line (offset/limit, default and cap 2000 lines, 1 MiB per response). Large files are read across multiple calls using `next_offset`. Bytes are cached on disk under the configured cache root (default ~/.myspec) at `project/<projectId>/file/<fileId>/rev/<rev>/<basename>` and reused on subsequent reads of the same revision, so paging through a file downloads it once. Files above 8 MiB and binary content are refused \u2014 use download_spec_file to save those to a local file instead.",
-  inputSchema: inputSchema17,
+  inputSchema: inputSchema18,
   handler: async (args, ctx) => {
     const meta = await ctx.client.getFileMetadata(args.file_id);
     const targetRevision = args.revision ?? meta.revisionCount;
@@ -5657,17 +5825,17 @@ function sha256Prefixed2(content) {
 }
 
 // src/server/tools/rename_spec_session.ts
-import { z as z18 } from "zod";
-var inputSchema18 = {
-  session_id: z18.string().min(1).describe("UUID of the spec session to rename"),
-  session_summary: z18.string().min(1).max(SESSION_SUMMARY_MAX_LENGTH).describe(
+import { z as z19 } from "zod";
+var inputSchema19 = {
+  session_id: z19.string().min(1).describe("UUID of the spec session to rename"),
+  session_summary: z19.string().min(1).max(SESSION_SUMMARY_MAX_LENGTH).describe(
     `New human-readable session title (max ${String(SESSION_SUMMARY_MAX_LENGTH)} characters). Stored as context.sessionSummary \u2014 the field the webapp displays and searches.`
   )
 };
 var renameSpecSessionTool = {
   name: "rename_spec_session",
   description: "Rename a spec session by updating its context.sessionSummary \u2014 the session's human-readable title (there is no first-class name field). Permitted on both active and archived sessions. All other context keys are preserved untouched.",
-  inputSchema: inputSchema18,
+  inputSchema: inputSchema19,
   handler: async (args, ctx) => {
     if (args.session_summary.length > SESSION_SUMMARY_MAX_LENGTH) {
       return errorResult(
@@ -5701,14 +5869,14 @@ var renameSpecSessionTool = {
 };
 
 // src/server/tools/restore_spec_file_from_trash.ts
-import { z as z19 } from "zod";
-var inputSchema19 = {
-  file_id: z19.string().min(1).describe("UUID of the spec file to restore from the Trash Bin.")
+import { z as z20 } from "zod";
+var inputSchema20 = {
+  file_id: z20.string().min(1).describe("UUID of the spec file to restore from the Trash Bin.")
 };
 var restoreSpecFileFromTrashTool = {
   name: "restore_spec_file_from_trash",
   description: "Restore a spec file from the Trash Bin back to the active file list, reversing `move_spec_file_to_trash`. The file becomes visible again to the default file list and AI-agent tools.",
-  inputSchema: inputSchema19,
+  inputSchema: inputSchema20,
   handler: async (args, ctx) => {
     await ctx.client.restoreFile(args.file_id);
     return jsonResult({ restored: true, file_id: args.file_id });
@@ -5716,14 +5884,14 @@ var restoreSpecFileFromTrashTool = {
 };
 
 // src/server/tools/unarchive_project.ts
-import { z as z20 } from "zod";
-var inputSchema20 = {
-  project_id: z20.string().min(1).describe("UUID of the project to unarchive.")
+import { z as z21 } from "zod";
+var inputSchema21 = {
+  project_id: z21.string().min(1).describe("UUID of the project to unarchive.")
 };
 var unarchiveProjectTool = {
   name: "unarchive_project",
   description: 'Unarchive a project (sets status to "active"). Idempotent: unarchiving an already-active project succeeds.',
-  inputSchema: inputSchema20,
+  inputSchema: inputSchema21,
   handler: async (args, ctx) => {
     const project = await ctx.client.unarchiveProject(args.project_id);
     return jsonResult({ project: projectSummary(project) });
@@ -5731,14 +5899,14 @@ var unarchiveProjectTool = {
 };
 
 // src/server/tools/unarchive_spec_session.ts
-import { z as z21 } from "zod";
-var inputSchema21 = {
-  session_id: z21.string().min(1).describe("UUID of the spec session to unarchive")
+import { z as z22 } from "zod";
+var inputSchema22 = {
+  session_id: z22.string().min(1).describe("UUID of the spec session to unarchive")
 };
 var unarchiveSpecSessionTool = {
   name: "unarchive_spec_session",
   description: "Unarchive a spec session, returning it to the active list.",
-  inputSchema: inputSchema21,
+  inputSchema: inputSchema22,
   handler: async (args, ctx) => {
     let session;
     try {
@@ -5755,19 +5923,19 @@ var unarchiveSpecSessionTool = {
 };
 
 // src/server/tools/update_project.ts
-import { z as z22 } from "zod";
-var inputSchema22 = {
-  project_id: z22.string().min(1).describe("UUID of the project to update."),
-  name: z22.string().min(1).optional().describe("New project name."),
-  description: z22.string().optional().describe("New project description."),
-  project_type: z22.enum(["greenfield", "brownfield", "auto"]).optional().describe(
+import { z as z23 } from "zod";
+var inputSchema23 = {
+  project_id: z23.string().min(1).describe("UUID of the project to update."),
+  name: z23.string().min(1).optional().describe("New project name."),
+  description: z23.string().optional().describe("New project description."),
+  project_type: z23.enum(["greenfield", "brownfield", "auto"]).optional().describe(
     "Codebase type. 'greenfield' or 'brownfield' sets it explicitly; 'auto' clears it so the workflow decides. Omit to leave unchanged."
   )
 };
 var updateProjectTool = {
   name: "update_project",
   description: "Update a project's metadata (name, description, project_type). Returns the updated metadata.",
-  inputSchema: inputSchema22,
+  inputSchema: inputSchema23,
   handler: async (args, ctx) => {
     if (args.name === void 0 && args.description === void 0 && args.project_type === void 0) {
       return errorResult(
@@ -5790,7 +5958,7 @@ var updateProjectTool = {
 };
 
 // src/server/tools/update_spec_file.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 
 // src/server/tools/spec-content-source.ts
 import { readFile, stat } from "fs/promises";
@@ -5846,24 +6014,24 @@ async function resolveSpecContent(input, maxBytes = MAX_LOCAL_SPEC_FILE_BYTES) {
 }
 
 // src/server/tools/update_spec_file.ts
-var inputSchema23 = {
-  file_id: z23.string().min(1).optional().describe("UUID of the spec file to overwrite. Provide this or (project_id + file_path)."),
-  project_id: z23.string().min(1).optional().describe("UUID of the project. Required (with file_path) when file_id is not given."),
-  file_path: z23.string().min(1).optional().describe("Path of the spec file. Required (with project_id) when file_id is not given."),
-  content: z23.string().min(1).optional().describe(
+var inputSchema24 = {
+  file_id: z24.string().min(1).optional().describe("UUID of the spec file to overwrite. Provide this or (project_id + file_path)."),
+  project_id: z24.string().min(1).optional().describe("UUID of the project. Required (with file_path) when file_id is not given."),
+  file_path: z24.string().min(1).optional().describe("Path of the spec file. Required (with project_id) when file_id is not given."),
+  content: z24.string().min(1).optional().describe(
     "Full UTF-8 replacement content, saved as a new revision. Provide this OR local_file_path (exactly one). Use for in-memory / generated content."
   ),
-  local_file_path: z23.string().min(1).optional().describe(
+  local_file_path: z24.string().min(1).optional().describe(
     "Path to a local file whose bytes become the new revision; the server reads it directly. Provide this OR content (exactly one). Absolute paths are most reliable; a relative path resolves against the MCP server working directory. Point this only at an intended spec file \u2014 its bytes are uploaded to the project as-is; never use it for secrets or unrelated files."
   ),
-  expected_version: z23.number().int().nonnegative().optional().describe(
+  expected_version: z24.number().int().nonnegative().optional().describe(
     "The content_version the new body was based on, from the get_spec_file or read_spec_file you worked from. The update is rejected with an actionable error if someone else changed the file since. Omit only when overwriting unconditionally is genuinely intended \u2014 the project may be configured to reject unversioned updates."
   )
 };
 var updateSpecFileTool = {
   name: "update_spec_file",
   description: "Overwrite an existing spec file by saving a new revision. Provide the new body inline via `content` or by pointing at a local file with `local_file_path` \u2014 exactly one is required. Prefer `local_file_path` when the body is already an existing local file (the server reads it directly); use `content` for text generated in-memory. Reference the file by file_id or by (project_id + file_path). Pass `expected_version` from the get_spec_file you based the new body on so a concurrent edit by someone else is reported instead of silently overwritten.",
-  inputSchema: inputSchema23,
+  inputSchema: inputSchema24,
   handler: async (args, ctx) => {
     const resolved = await resolveSpecContent({
       content: args.content,
@@ -5925,7 +6093,7 @@ function conflictMessage(filePath, conflict) {
 }
 
 // src/server/tools/spec_file_comments.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 var LIST_BODY_PREVIEW_CHARS = 1e3;
 var LIST_MAX_THREADS = 100;
 function commentSummary(comment, opts = {}) {
@@ -5971,7 +6139,7 @@ function threadSummary(thread, opts = {}) {
   };
 }
 function uuidField(what) {
-  return z24.uuid().describe(what);
+  return z25.uuid().describe(what);
 }
 var CONFLICT_REASON = {
   fileTrashed: "file_trashed",
@@ -5995,7 +6163,7 @@ function conflictAdvice(err, parts) {
 }
 var listInputSchema = {
   file_id: uuidField("UUID of the spec file whose comments to list."),
-  status: z24.enum(["open", "resolved", "orphaned"]).optional().describe(
+  status: z25.enum(["open", "resolved", "orphaned"]).optional().describe(
     "Narrow to open (unresolved) threads, resolved ones, or orphaned ones whose passage can no longer be located. Omit for all of them."
   )
 };
@@ -6019,19 +6187,19 @@ var listSpecFileCommentsTool = {
 };
 var createInputSchema = {
   file_id: uuidField("UUID of the spec file to comment on."),
-  body: z24.string().min(1).max(MAX_COMMENT_BODY_LENGTH).describe("The comment text, in markdown."),
+  body: z25.string().min(1).max(MAX_COMMENT_BODY_LENGTH).describe("The comment text, in markdown."),
   // The three anchor limits are exported by the contract for exactly this, and
   // the context one is SHORT (64). A description reading "the text immediately
   // BEFORE the quote" invites a whole preceding sentence, which is the default
   // reading rather than a corner case — so the ceiling is enforced in the
   // schema, where the model sees it, rather than discovered as a 400.
-  anchor_quote: z24.string().min(1).max(MAX_ANCHOR_QUOTE_LENGTH).describe(
+  anchor_quote: z25.string().min(1).max(MAX_ANCHOR_QUOTE_LENGTH).describe(
     `The exact passage this comment is about, copied verbatim from the file. The server searches the current content for it, so it must match the text as written. Read the file with read_spec_file first. At most ${String(MAX_ANCHOR_QUOTE_LENGTH)} characters.`
   ),
-  anchor_prefix: z24.string().max(MAX_ANCHOR_CONTEXT_LENGTH).optional().describe(
+  anchor_prefix: z25.string().max(MAX_ANCHOR_CONTEXT_LENGTH).optional().describe(
     `The text immediately BEFORE the quote, which disambiguates a passage appearing more than once. At most ${String(MAX_ANCHOR_CONTEXT_LENGTH)} characters \u2014 a few words, not a sentence. Send an empty string when the quote starts the file.`
   ),
-  anchor_suffix: z24.string().max(MAX_ANCHOR_CONTEXT_LENGTH).optional().describe(
+  anchor_suffix: z25.string().max(MAX_ANCHOR_CONTEXT_LENGTH).optional().describe(
     `The text immediately AFTER the quote. At most ${String(MAX_ANCHOR_CONTEXT_LENGTH)} characters. Empty when the quote ends the file.`
   )
 };
@@ -6072,7 +6240,7 @@ var createSpecFileCommentThreadTool = {
 var replyInputSchema = {
   file_id: uuidField("UUID of the spec file the thread belongs to."),
   thread_id: uuidField("UUID of the thread to reply to, from list_spec_file_comments."),
-  body: z24.string().min(1).max(MAX_COMMENT_BODY_LENGTH).describe("The reply text, in markdown.")
+  body: z25.string().min(1).max(MAX_COMMENT_BODY_LENGTH).describe("The reply text, in markdown.")
 };
 var replySpecFileCommentThreadTool = {
   name: "reply_spec_file_comment_thread",
@@ -6102,8 +6270,8 @@ var replySpecFileCommentThreadTool = {
 var updateInputSchema = {
   file_id: uuidField("UUID of the spec file the comment belongs to."),
   comment_id: uuidField("UUID of the comment to edit. Must be your own."),
-  body: z24.string().min(1).max(MAX_COMMENT_BODY_LENGTH).describe("The replacement text, in markdown. Replaces the comment entirely."),
-  expected_version: z24.number().int().nonnegative().optional().describe(
+  body: z25.string().min(1).max(MAX_COMMENT_BODY_LENGTH).describe("The replacement text, in markdown. Replaces the comment entirely."),
+  expected_version: z25.number().int().nonnegative().optional().describe(
     "The COMMENT's own content_version as last read by list_spec_file_comments \u2014 not the file's. Sending it makes the edit fail rather than silently overwrite one made since."
   )
 };
@@ -6162,7 +6330,7 @@ var deleteSpecFileCommentTool = {
 import { createHash as createHash3 } from "crypto";
 import { lstat, readFile as readFile2 } from "fs/promises";
 import { basename, extname, isAbsolute as isAbsolute2 } from "path";
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 var DEFAULT_MIME = "application/octet-stream";
 var MAX_ATTACHMENT_MB2 = MAX_ATTACHMENT_BYTES / (1024 * 1024);
 var STRUCTURED_EXTENSION_MIME = {
@@ -6267,23 +6435,23 @@ function inferMimeFromName(name) {
   }
   return DEFAULT_MIME;
 }
-var inputSchema24 = {
-  project_id: z25.string().min(1).describe("UUID of the project to attach the file to."),
-  file_path: z25.string().min(1).describe(
+var inputSchema25 = {
+  project_id: z26.string().min(1).describe("UUID of the project to attach the file to."),
+  file_path: z26.string().min(1).describe(
     "Absolute path to the local file to upload. The MCP server reads this path from its own host."
   ),
-  file_name: z25.string().min(1).optional().describe("Override the filename recorded on the attachment. Defaults to the path basename."),
-  mime_type: z25.string().min(1).optional().describe(
+  file_name: z26.string().min(1).optional().describe("Override the filename recorded on the attachment. Defaults to the path basename."),
+  mime_type: z26.string().min(1).optional().describe(
     "Override the MIME type sent to the platform. The platform re-detects from content, so this is only a hint. If omitted, inferred from the file extension \u2014 structured (.pdf, .docx, .xlsx) keep their canonical MIME; common UTF-8 text formats (.xml, .json, .yaml, .html, .csv, .md, source code, ...) are sent as text/plain."
   ),
-  override: z25.boolean().optional().describe(
+  override: z26.boolean().optional().describe(
     "When true, any existing (non-deleted) attachment on the project whose recorded filename exactly matches `file_name` (or the path basename) is soft-deleted before the new upload, so the new attachment keeps the original name instead of getting an auto-dedup `(1)` suffix. The platform has no in-place content-replace API, so the new upload always gets a new `attachment_id`; any replaced ids are returned as `overridden_attachment_ids` (array, possibly empty) so callers can refresh stored references. Defaults to false (let the platform auto-dedup)."
   )
 };
 var uploadAttachmentTool = {
   name: "upload_attachment",
   description: `Upload a local file as a new attachment on a project. Reads \`file_path\` from the host running the MCP server, computes its SHA256, then performs the two-phase platform upload. Max ${String(MAX_ATTACHMENT_MB2)} MB. Supported content: PDF, DOCX, XLSX, images (PNG, JPEG, GIF, WEBP), and any UTF-8 text file (XML, JSON, YAML, HTML, SVG, Markdown, CSV, source code, ...). Other binary files are rejected by the platform.`,
-  inputSchema: inputSchema24,
+  inputSchema: inputSchema25,
   handler: async (args, ctx) => {
     if (!isAbsolute2(args.file_path)) {
       return errorResult(`file_path must be an absolute path; got "${args.file_path}".`);
@@ -6407,53 +6575,7 @@ var uploadAttachmentTool = {
 };
 
 // src/server/tools/upload_spec_file.ts
-import { z as z26 } from "zod";
-
-// src/server/spec-path.ts
-var MAX_SPEC_DIR_DEPTH = 3;
-function validateSpecFilePath(filePath) {
-  if (!filePath) {
-    return "file_path is required.";
-  }
-  if (filePath.startsWith("/")) {
-    return "file_path must be a relative path, not an absolute path.";
-  }
-  const segments = filePath.split("/");
-  if (segments.some((s) => s === "..")) {
-    return "file_path must not contain '..' (parent directory) segments.";
-  }
-  if (segments.some((s) => s === "" || s === ".")) {
-    return 'file_path must be a normalized path (no empty, "." or trailing-slash segments).';
-  }
-  const root = segments[0];
-  if (root !== "specs" && root !== "openspec") {
-    return "file_path must be rooted at 'specs' or 'openspec' (e.g. specs/changes/add-oauth-login/proposal.md).";
-  }
-  if (segments.length < 2) {
-    return `file_path must include a filename under '${root}' (e.g. ${root}/proposal.md).`;
-  }
-  const dirLevels = segments.length - 2;
-  if (dirLevels > MAX_SPEC_DIR_DEPTH) {
-    return `file_path must not nest deeper than ${String(MAX_SPEC_DIR_DEPTH)} directory levels below the '${root}' root.`;
-  }
-  return null;
-}
-var FILE_TYPE_BY_BASENAME = {
-  constitution: "constitution",
-  requirements: "requirements",
-  solution: "solution",
-  tasks: "tasks",
-  // Enterprise greenfield quality plan (generate-greenfield-enterprise).
-  quality: "quality",
-  proposal: "proposal"
-};
-function deriveFileType(filePath) {
-  const filename = filePath.split("/").pop() ?? "";
-  const base = filename.replace(/\.[^.]+$/, "").toLowerCase();
-  return FILE_TYPE_BY_BASENAME[base] ?? "openspec-spec";
-}
-
-// src/server/tools/upload_spec_file.ts
+import { z as z27 } from "zod";
 var SPEC_FILE_TYPES = [
   "constitution",
   "requirements",
@@ -6463,23 +6585,23 @@ var SPEC_FILE_TYPES = [
   "proposal",
   "openspec-spec"
 ];
-var inputSchema25 = {
-  project_id: z26.string().min(1).describe("UUID of the project to upload the file into."),
-  file_path: z26.string().min(1).describe(
+var inputSchema26 = {
+  project_id: z27.string().min(1).describe("UUID of the project to upload the file into."),
+  file_path: z27.string().min(1).describe(
     'Path of the new spec file, rooted at "specs" or "openspec" with at most 3 directory levels below the root (e.g. specs/changes/add-oauth-login/proposal.md).'
   ),
-  content: z26.string().min(1).optional().describe(
+  content: z27.string().min(1).optional().describe(
     "Full UTF-8 text content of the spec file. Provide this OR local_file_path (exactly one). Use for in-memory / generated content."
   ),
-  local_file_path: z26.string().min(1).optional().describe(
+  local_file_path: z27.string().min(1).optional().describe(
     "Path to a local file whose bytes become the spec file body; the server reads it directly. Provide this OR content (exactly one). Absolute paths are most reliable; a relative path resolves against the MCP server working directory. Point this only at an intended spec file \u2014 its bytes are uploaded to the project as-is; never use it for secrets or unrelated files."
   ),
-  file_type: z26.enum(SPEC_FILE_TYPES).optional().describe("Spec file type. Omit to derive from the filename (e.g. proposal.md \u2192 proposal).")
+  file_type: z27.enum(SPEC_FILE_TYPES).optional().describe("Spec file type. Omit to derive from the filename (e.g. proposal.md \u2192 proposal).")
 };
 var uploadSpecFileTool = {
   name: "upload_spec_file",
   description: "Upload a new, session-less spec file into a project. Provide the file body inline via `content` or by pointing at a local file with `local_file_path` \u2014 exactly one is required. Prefer `local_file_path` when the body is already an existing local file (the server reads it directly, avoiding sending large content through the model); use `content` for text generated in-memory. Rejects if a file already exists at the same path (use update_spec_file to overwrite).",
-  inputSchema: inputSchema25,
+  inputSchema: inputSchema26,
   handler: async (args, ctx) => {
     const pathError = validateSpecFilePath(args.file_path);
     if (pathError) {
@@ -6510,16 +6632,16 @@ var uploadSpecFileTool = {
 };
 
 // src/server/tools/list_artifacts.ts
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 
 // src/server/tools/artifact-output.ts
-import { z as z27 } from "zod";
-var artifactFilesSchema = z27.array(
-  z27.object({
-    path: z27.string().min(1).describe('Bundle-relative path, "/"-separated, no leading slash (e.g. assets/logo.svg).'),
-    content: z27.string().describe("The file content, in `encoding` (default utf8)."),
-    encoding: z27.enum(["utf8", "base64"]).optional().describe("utf8 (default) for text; base64 for binary files such as images."),
-    content_type: z27.string().optional().describe("Hint used only for extensions the platform does not recognise.")
+import { z as z28 } from "zod";
+var artifactFilesSchema = z28.array(
+  z28.object({
+    path: z28.string().min(1).describe('Bundle-relative path, "/"-separated, no leading slash (e.g. assets/logo.svg).'),
+    content: z28.string().describe("The file content, in `encoding` (default utf8)."),
+    encoding: z28.enum(["utf8", "base64"]).optional().describe("utf8 (default) for text; base64 for binary files such as images."),
+    content_type: z28.string().optional().describe("Hint used only for extensions the platform does not recognise.")
   })
 ).describe("Files of the bundle.");
 function artifactSummary(a) {
@@ -6591,15 +6713,15 @@ function artifactCreateConflictMessage(conflict) {
 // src/server/tools/list_artifacts.ts
 var LIST_DEFAULT4 = 50;
 var LIST_MAX4 = 100;
-var inputSchema26 = {
-  project_id: z28.string().min(1).describe("UUID of the project whose artifacts to list."),
-  limit: z28.number().int().positive().optional().describe(`Max artifacts to return (default ${String(LIST_DEFAULT4)}, capped at ${String(LIST_MAX4)}).`),
-  offset: z28.number().int().nonnegative().optional().describe("Pagination offset (default 0).")
+var inputSchema27 = {
+  project_id: z29.string().min(1).describe("UUID of the project whose artifacts to list."),
+  limit: z29.number().int().positive().optional().describe(`Max artifacts to return (default ${String(LIST_DEFAULT4)}, capped at ${String(LIST_MAX4)}).`),
+  offset: z29.number().int().nonnegative().optional().describe("Pagination offset (default 0).")
 };
 var listArtifactsTool = {
   name: "list_artifacts",
   description: "List a project's live artifacts (multi-file bundles such as HTML mockups, each versioned as one snapshot) with id, slug, entry path and revision_count. Returns `total` and, when more remain, `next_offset`. Use get_artifact for the file manifest and read_artifact_file for content.",
-  inputSchema: inputSchema26,
+  inputSchema: inputSchema27,
   handler: async (args, ctx) => {
     const limit = clampLimit(args.limit, LIST_DEFAULT4, LIST_MAX4);
     const offset = args.offset ?? 0;
@@ -6617,15 +6739,15 @@ var listArtifactsTool = {
 };
 
 // src/server/tools/get_artifact.ts
-import { z as z29 } from "zod";
-var inputSchema27 = {
-  artifact_id: z29.string().min(1).describe("UUID of the artifact."),
-  revision: z29.number().int().positive().optional().describe("Revision whose manifest to return (defaults to the head revision).")
+import { z as z30 } from "zod";
+var inputSchema28 = {
+  artifact_id: z30.string().min(1).describe("UUID of the artifact."),
+  revision: z30.number().int().positive().optional().describe("Revision whose manifest to return (defaults to the head revision).")
 };
 var getArtifactTool = {
   name: "get_artifact",
   description: "Get an artifact's metadata plus the file manifest (path, content type, size, checksum of every file) of its head revision, or of `revision` when given. `revision_count` is the head number AND the value to pass as expected_version when writing; it only ever grows because rollback appends a revision rather than discarding history.",
-  inputSchema: inputSchema27,
+  inputSchema: inputSchema28,
   handler: async (args, ctx) => {
     const detail = await ctx.client.getArtifact(args.artifact_id);
     if (args.revision === void 0) {
@@ -6642,19 +6764,19 @@ var getArtifactTool = {
 };
 
 // src/server/tools/read_artifact_file.ts
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 var MAX_READABLE_ARTIFACT_FILE_BYTES = 8 * 1024 * 1024;
-var inputSchema28 = {
-  artifact_id: z30.string().min(1).describe("UUID of the artifact."),
-  path: z30.string().min(1).describe("Bundle-relative path of the file (e.g. index.html, assets/app.js)."),
-  revision: z30.number().int().positive().optional().describe("Revision to read from (defaults to the head revision)."),
-  offset: z30.number().int().nonnegative().optional().describe("1-based line number to start reading from (default 1; 0 is an alias for 1)."),
-  limit: z30.number().int().positive().optional().describe("Max lines to return (default 2000, capped at 2000; larger values are clamped).")
+var inputSchema29 = {
+  artifact_id: z31.string().min(1).describe("UUID of the artifact."),
+  path: z31.string().min(1).describe("Bundle-relative path of the file (e.g. index.html, assets/app.js)."),
+  revision: z31.number().int().positive().optional().describe("Revision to read from (defaults to the head revision)."),
+  offset: z31.number().int().nonnegative().optional().describe("1-based line number to start reading from (default 1; 0 is an alias for 1)."),
+  limit: z31.number().int().positive().optional().describe("Max lines to return (default 2000, capped at 2000; larger values are clamped).")
 };
 var readArtifactFileTool = {
   name: "read_artifact_file",
   description: "Return one artifact file's UTF-8 content, paginated by line (offset/limit, default and cap 2000 lines, 1 MiB per response) with `total_lines`, `truncated` and `next_offset`. Reads the head revision unless `revision` is given. Binary files (images, fonts) cannot be read through this tool; get_artifact lists their size and checksum.",
-  inputSchema: inputSchema28,
+  inputSchema: inputSchema29,
   handler: async (args, ctx) => {
     const file = await ctx.client.downloadArtifactFile(args.artifact_id, args.path, args.revision);
     if (file.content.byteLength > MAX_READABLE_ARTIFACT_FILE_BYTES) {
@@ -6689,20 +6811,20 @@ var readArtifactFileTool = {
 };
 
 // src/server/tools/create_artifact.ts
-import { z as z31 } from "zod";
-var inputSchema29 = {
-  project_id: z31.string().min(1).describe("UUID of the project to create the artifact in."),
-  name: z31.string().min(1).describe("Display name (max 200 characters)."),
-  slug: z31.string().optional().describe("URL-safe identifier, unique within the project; derived from the name when omitted."),
-  description: z31.string().optional().describe("Optional description (max 2000 characters)."),
-  entry_path: z31.string().optional().describe("The file a renderer opens first. Defaults to index.html when present, else the only file."),
-  message: z31.string().optional().describe("Short summary of this first revision (max 500 characters)."),
+import { z as z32 } from "zod";
+var inputSchema30 = {
+  project_id: z32.string().min(1).describe("UUID of the project to create the artifact in."),
+  name: z32.string().min(1).describe("Display name (max 200 characters)."),
+  slug: z32.string().optional().describe("URL-safe identifier, unique within the project; derived from the name when omitted."),
+  description: z32.string().optional().describe("Optional description (max 2000 characters)."),
+  entry_path: z32.string().optional().describe("The file a renderer opens first. Defaults to index.html when present, else the only file."),
+  message: z32.string().optional().describe("Short summary of this first revision (max 500 characters)."),
   files: artifactFilesSchema
 };
 var createArtifactTool = {
   name: "create_artifact",
   description: "Create an artifact \u2014 a bundle of files (e.g. an HTML mockup: index.html + styles.css + app.js) the platform versions AS ONE snapshot \u2014 with the given files as revision 1. At most 50 files, 2 MiB per file, 10 MiB per revision. Fails with a conflict when the slug is already taken in the project (trashed artifacts still own their slug).",
-  inputSchema: inputSchema29,
+  inputSchema: inputSchema30,
   handler: async (args, ctx) => {
     try {
       const result = await ctx.client.createArtifact(args.project_id, {
@@ -6730,24 +6852,24 @@ var createArtifactTool = {
 };
 
 // src/server/tools/write_artifact_revision.ts
-import { z as z32 } from "zod";
-var inputSchema30 = {
-  artifact_id: z32.string().min(1).describe("UUID of the artifact."),
+import { z as z33 } from "zod";
+var inputSchema31 = {
+  artifact_id: z33.string().min(1).describe("UUID of the artifact."),
   files: artifactFilesSchema,
-  base_revision: z32.number().int().positive().optional().describe(
+  base_revision: z33.number().int().positive().optional().describe(
     "PATCH mode: start from this revision's files, upsert `files` by path and drop `remove` paths. Omit for FULL mode, where `files` is the complete new file set. Patch mode defaults expected_version to base_revision."
   ),
-  remove: z32.array(z32.string().min(1)).optional().describe("Patch mode only: paths to drop from the base revision."),
-  expected_version: z32.number().int().nonnegative().optional().describe(
+  remove: z33.array(z33.string().min(1)).optional().describe("Patch mode only: paths to drop from the base revision."),
+  expected_version: z33.number().int().nonnegative().optional().describe(
     "The revision_count this write is based on (from get_artifact). The platform refuses the write with a conflict if the head moved. Defaults to base_revision in patch mode, else the current head."
   ),
-  message: z32.string().optional().describe("Short summary of the change (max 500 characters)."),
-  entry_path: z32.string().optional().describe("Change the file a renderer opens first, from this revision on.")
+  message: z33.string().optional().describe("Short summary of the change (max 500 characters)."),
+  entry_path: z33.string().optional().describe("Change the file a renderer opens first, from this revision on.")
 };
 var writeArtifactRevisionTool = {
   name: "write_artifact_revision",
   description: "Write a new revision of an artifact. FULL mode (no base_revision): `files` becomes the whole bundle. PATCH mode (base_revision set): only the changed files are sent, plus `remove` for paths to drop \u2014 the platform stores the complete result either way. Every revision is immutable; the newest N are retained (50 by default, set by the platform; older ones are pruned); use rollback_artifact to restore an earlier one. Read the current head with get_artifact first and pass its revision_count as expected_version.",
-  inputSchema: inputSchema30,
+  inputSchema: inputSchema31,
   handler: async (args, ctx) => {
     if (args.remove && args.remove.length > 0 && args.base_revision === void 0) {
       return errorResult("`remove` is only valid in patch mode: set base_revision to the revision you are editing.");
@@ -6781,17 +6903,17 @@ var writeArtifactRevisionTool = {
 };
 
 // src/server/tools/rollback_artifact.ts
-import { z as z33 } from "zod";
-var inputSchema31 = {
-  artifact_id: z33.string().min(1).describe("UUID of the artifact."),
-  revision_number: z33.number().int().positive().describe("The revision whose files to restore."),
-  expected_version: z33.number().int().nonnegative().optional().describe("The revision_count this rollback is based on (from get_artifact); defaults to the current head."),
-  message: z33.string().optional().describe('Optional summary; defaults to "Rolled back to revision N".')
+import { z as z34 } from "zod";
+var inputSchema32 = {
+  artifact_id: z34.string().min(1).describe("UUID of the artifact."),
+  revision_number: z34.number().int().positive().describe("The revision whose files to restore."),
+  expected_version: z34.number().int().nonnegative().optional().describe("The revision_count this rollback is based on (from get_artifact); defaults to the current head."),
+  message: z34.string().optional().describe('Optional summary; defaults to "Rolled back to revision N".')
 };
 var rollbackArtifactTool = {
   name: "rollback_artifact",
   description: "Restore an earlier revision of an artifact. Like `git revert`, this APPENDS a new revision whose files equal the chosen one \u2014 history is never rewritten, and the new head is revision_count + 1. Only the newest N revisions are retained (50 by default, set by the platform): older ones are pruned, and rolling back to a pruned revision fails with not found \u2014 list the revisions (get_artifact) first when in doubt. Rolling back to the head itself is allowed and recorded with no_change=true.",
-  inputSchema: inputSchema31,
+  inputSchema: inputSchema32,
   handler: async (args, ctx) => {
     try {
       const result = await ctx.client.rollbackArtifact(
@@ -6811,10 +6933,10 @@ var rollbackArtifactTool = {
 };
 
 // src/server/tools/create_stream_token.ts
-import { z as z35 } from "zod";
+import { z as z36 } from "zod";
 
 // src/server/tools/stream-token-output.ts
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 var projectStreamEventTypes = [
   "project.updated",
   "project.deleted",
@@ -6833,7 +6955,7 @@ var projectStreamEventTypes = [
   "spec_session.deleted",
   "*"
 ];
-var streamEventTypesSchema = z34.array(z34.enum(projectStreamEventTypes)).min(1).describe(
+var streamEventTypesSchema = z35.array(z35.enum(projectStreamEventTypes)).min(1).describe(
   'Event types to receive. Required \u2014 pass ["*"] to follow all of them. spec_file.updated covers new revisions, rollbacks, and moves to or from the trash; spec_file.lock covers acquire, renew, release and takeover; spec_session.updated covers completion, archive, unarchive and rename; spec_file_comment.updated covers a body edit and a soft delete, thread_state_changed covers resolve and unresolve, and anchors_updated is batched across every thread one save moved.'
 );
 function streamTokenSummary(token) {
@@ -6863,19 +6985,19 @@ function streamTokenMintOutput(result) {
 }
 
 // src/server/tools/create_stream_token.ts
-var inputSchema32 = {
-  resource_type: z35.enum(["project"]).default("project").describe("What to follow. Only 'project' is supported today."),
-  resource_id: z35.string().min(1).describe("UUID of the project to stream events for."),
+var inputSchema33 = {
+  resource_type: z36.enum(["project"]).default("project").describe("What to follow. Only 'project' is supported today."),
+  resource_id: z36.string().min(1).describe("UUID of the project to stream events for."),
   event_types: streamEventTypesSchema,
-  ttl_seconds: z35.number().int().positive().optional().describe(
+  ttl_seconds: z36.number().int().positive().optional().describe(
     "How long the URL stays valid. Defaults to 24 hours, capped at 7 days. Out-of-range values are clamped rather than rejected \u2014 check expires_at in the result."
   ),
-  label: z35.string().optional().describe("Short human-readable label, so a person can recognise this token in a listing.")
+  label: z36.string().optional().describe("Short human-readable label, so a person can recognise this token in a listing.")
 };
 var createStreamTokenTool = {
   name: "create_stream_token",
   description: "Create a short-lived WebSocket URL that streams a project's events in real time \u2014 like an S3 presigned URL, the returned URL is the whole credential and needs no auth header. Choose the project and the event types to follow; the result carries the full wss:// URL. Feed it to any WebSocket client with subprotocol 'v1' (for example Claude Code's Monitor tool). Each text frame is one JSON event carrying a `seq` cursor; reconnect with ?after=<seq> to resume without missing events. Defaults to 24 hours, 7 days maximum. TREAT THE RETURNED URL LIKE A PASSWORD: anyone holding it can read every event on this project until it expires, without authenticating. Pass it directly to the WebSocket client; never write it to a file, a commit, an issue or a chat reply, and never log or repeat it. It is shown once and cannot be retrieved again. If it may have been exposed, revoke it at once with revoke_stream_token \u2014 that is also how you end one early. Prefer the shortest ttl_seconds that covers the work.",
-  inputSchema: inputSchema32,
+  inputSchema: inputSchema33,
   handler: async (args, ctx) => {
     const result = await ctx.client.createStreamToken({
       resourceType: args.resource_type,
@@ -6889,22 +7011,22 @@ var createStreamTokenTool = {
 };
 
 // src/server/tools/list_stream_tokens.ts
-import { z as z36 } from "zod";
+import { z as z37 } from "zod";
 var LIST_DEFAULT5 = 50;
 var LIST_MAX5 = 200;
-var inputSchema33 = {
-  resource_id: z36.string().optional().describe("Only tokens following this project."),
-  live_only: z36.boolean().optional().describe("Hide expired and revoked tokens."),
-  mine_only: z36.boolean().optional().describe(
+var inputSchema34 = {
+  resource_id: z37.string().optional().describe("Only tokens following this project."),
+  live_only: z37.boolean().optional().describe("Hide expired and revoked tokens."),
+  mine_only: z37.boolean().optional().describe(
     "Only tokens you created. Off by default, so a leaked URL can be found \u2014 note that revoking one you did not mint needs the organisation owner or admin role."
   ),
-  limit: z36.number().int().positive().optional().describe(`Max tokens to return (default ${String(LIST_DEFAULT5)}, capped at ${String(LIST_MAX5)}).`),
-  offset: z36.number().int().nonnegative().optional().describe("Pagination offset (default 0).")
+  limit: z37.number().int().positive().optional().describe(`Max tokens to return (default ${String(LIST_DEFAULT5)}, capped at ${String(LIST_MAX5)}).`),
+  offset: z37.number().int().nonnegative().optional().describe("Pagination offset (default 0).")
 };
 var listStreamTokensTool = {
   name: "list_stream_tokens",
   description: "List the stream tokens in your organisation, with their scope, expiry and whether each is still live. Secrets are never returned \u2014 only a short prefix to tell tokens apart. Returns `total` and, when more remain, `next_offset`.",
-  inputSchema: inputSchema33,
+  inputSchema: inputSchema34,
   handler: async (args, ctx) => {
     const limit = clampLimit(args.limit, LIST_DEFAULT5, LIST_MAX5);
     const offset = args.offset ?? 0;
@@ -6927,14 +7049,14 @@ var listStreamTokensTool = {
 };
 
 // src/server/tools/revoke_stream_token.ts
-import { z as z37 } from "zod";
-var inputSchema34 = {
-  id: z37.string().min(1).describe("Token id (from create_stream_token or list_stream_tokens) \u2014 NOT the secret itself.")
+import { z as z38 } from "zod";
+var inputSchema35 = {
+  id: z38.string().min(1).describe("Token id (from create_stream_token or list_stream_tokens) \u2014 NOT the secret itself.")
 };
 var revokeStreamTokenTool = {
   name: "revoke_stream_token",
   description: "Revoke a stream token immediately, closing its URL and deleting the events buffered for it. Use this as soon as a stream is no longer needed, or if its URL may have leaked \u2014 the URL is the credential, so revoking is the only way to stop it before it expires. Revoking a token you minted yourself always works. Revoking one somebody ELSE minted additionally requires the organisation owner or admin role, and is refused with 403 otherwise \u2014 so when hunting a leaked URL you did not create, expect that refusal and ask an organisation owner or admin rather than retrying.",
-  inputSchema: inputSchema34,
+  inputSchema: inputSchema35,
   handler: async (args, ctx) => {
     const token = await ctx.client.revokeStreamToken(args.id);
     return jsonResult({ ...streamTokenSummary(token), revoked: true });
@@ -6942,7 +7064,7 @@ var revokeStreamTokenTool = {
 };
 
 // src/server/tools/start_spec_session.ts
-import { z as z38 } from "zod";
+import { z as z39 } from "zod";
 
 // src/server/tools/start-session-core.ts
 var START_SESSION_WAIT_MS = 75e3;
@@ -7334,28 +7456,28 @@ var START_SESSION_DESCRIPTION_BASE = "Start a NEW MySpec chat session on the use
 
 // src/server/tools/start_spec_session.ts
 var BRIDGE_COMMAND = "npx -y @myspec/mcp-server reverse --root <path>";
-var inputSchema35 = {
-  project_id: z38.string().min(1).describe("UUID of the project to start the session in."),
-  mode: z38.enum(["generate", "edit"]).describe(
+var inputSchema36 = {
+  project_id: z39.string().min(1).describe("UUID of the project to start the session in."),
+  mode: z39.enum(["generate", "edit"]).describe(
     "'generate' writes a new spec bundle from scratch; 'edit' changes the spec files of an existing bundle."
   ),
-  prompt: z38.string().min(1).describe(
+  prompt: z39.string().min(1).describe(
     "The opening message. Write it as the user would: what they want specced, and the repository context you have gathered that they would otherwise have to retype."
   ),
-  workflow_id: z38.string().optional().describe(
+  workflow_id: z39.string().optional().describe(
     "Workflow variant id, e.g. myspec-greenfield-v1, enterprise-greenfield-v1, speckit-greenfield-v1, openspec-brownfield-v1, myspec-brownfield-v1, myspec-edit-v1, myspec-edit-brownfield-v1. Omit to use the default for the chosen mode. Must agree with mode \u2014 a contradiction is rejected, not silently resolved."
   ),
-  language: z38.enum(SPEC_SESSION_LANGUAGES).optional().describe(
+  language: z39.enum(SPEC_SESSION_LANGUAGES).optional().describe(
     "Output language the session locks to on its first turn. Defaults to 'en'. A session's language is immutable once set."
   ),
-  model_id: z38.string().optional().describe("Model id to run the session with, e.g. openai:gpt-6-sol."),
-  attachment_ids: z38.array(z38.string().min(1)).max(MAX_REFERENCE_IDS).optional().describe(
+  model_id: z39.string().optional().describe("Model id to run the session with, e.g. openai:gpt-6-sol."),
+  attachment_ids: z39.array(z39.string().min(1)).max(MAX_REFERENCE_IDS).optional().describe(
     `Project attachment ids to cite in the opening message, as the composer @-mentions do. At most ${String(MAX_REFERENCE_IDS)}.`
   ),
-  spec_file_ids: z38.array(z38.string().min(1)).max(MAX_REFERENCE_IDS).optional().describe(
+  spec_file_ids: z39.array(z39.string().min(1)).max(MAX_REFERENCE_IDS).optional().describe(
     `Existing spec file ids to cite in the opening message. Required in practice for edit sessions. At most ${String(MAX_REFERENCE_IDS)}.`
   ),
-  session_title: z38.string().min(1).max(SESSION_TITLE_MAX_LENGTH).optional().describe(
+  session_title: z39.string().min(1).max(SESSION_TITLE_MAX_LENGTH).optional().describe(
     `Human-readable session title, stored as context.sessionSummary (max ${String(SESSION_TITLE_MAX_LENGTH)} characters). A workflow that names the session itself during its interview will overwrite it, exactly as in the webapp.`
   )
 };
@@ -7417,7 +7539,7 @@ async function resolveSpecFiles(ctx, projectId, ids) {
 var startSpecSessionTool = {
   name: "start_spec_session",
   description: START_SESSION_DESCRIPTION_BASE + BRIDGE_ORDERING_NOTE,
-  inputSchema: inputSchema35,
+  inputSchema: inputSchema36,
   handler: async (args, ctx) => {
     const webappUrl = httpUrlOrNull(ctx.webappUrl);
     if (webappUrl === null) {
@@ -7540,7 +7662,7 @@ var startSpecSessionTool = {
 };
 
 // src/server/tools/tasks.ts
-import { z as z39 } from "zod";
+import { z as z40 } from "zod";
 var LIST_DEFAULT_TASKS = 100;
 var LIST_MAX_TASKS = 500;
 var LIST_MAX_OFFSET = 1e6;
@@ -7548,8 +7670,8 @@ var DETAILS_PREVIEW_CHARS = 500;
 var ME = "me";
 var NONE = "none";
 var PRIORITY_NAMES = ["none", "urgent", "high", "medium", "low"];
-var STATUS = z39.enum(["pending", "in_progress", "done"]);
-var RELATIONSHIP_TYPE = z39.enum(["blocks", "blocked_by", "related"]);
+var STATUS = z40.enum(["pending", "in_progress", "done"]);
+var RELATIONSHIP_TYPE = z40.enum(["blocks", "blocked_by", "related"]);
 function toDay(date) {
   return date ? date.toISOString().slice(0, 10) : null;
 }
@@ -7584,33 +7706,33 @@ function taskSummary(task, opts = {}) {
     updated_at: task.updatedAt?.toISOString()
   };
 }
-var userIdField = z39.string().trim().min(1);
+var userIdField = z40.string().trim().min(1);
 async function resolveMe(id, ctx) {
   return id === ME ? ctx.client.currentUserId() : id;
 }
 var UNKNOWN_ME = 'Could not tell who you are from this connection, so "me" cannot be used. Pass your user id instead: list_task_assignees returns it as self_user_id.';
-var labelField = z39.string().trim().min(1).refine((label) => Array.from(label).length <= TASK_LIMITS.maxLabelLength, {
+var labelField = z40.string().trim().min(1).refine((label) => Array.from(label).length <= TASK_LIMITS.maxLabelLength, {
   message: `A label is at most ${String(TASK_LIMITS.maxLabelLength)} characters.`
 });
 function taskIdsField(what) {
-  return z39.array(z39.uuid()).min(1).max(TASK_LIMITS.maxTasksPerRequest).describe(`${what} At most ${String(TASK_LIMITS.maxTasksPerRequest)} per call.`);
+  return z40.array(z40.uuid()).min(1).max(TASK_LIMITS.maxTasksPerRequest).describe(`${what} At most ${String(TASK_LIMITS.maxTasksPerRequest)} per call.`);
 }
 var listInputSchema2 = {
-  project_id: z39.uuid().describe("UUID of the project whose tasks to list."),
+  project_id: z40.uuid().describe("UUID of the project whose tasks to list."),
   status: STATUS.optional().describe("Only tasks with this status."),
   assignee_user_id: userIdField.optional().describe(
     'Only tasks assigned to this user id (as returned in assignee_user_id or by list_task_assignees). "me" means you; "none" means unassigned tasks.'
   ),
-  cycle: z39.number().int().min(1).max(TASK_LIMITS.maxCycle).optional().describe("Only tasks in this cycle (sprint) number."),
+  cycle: z40.number().int().min(1).max(TASK_LIMITS.maxCycle).optional().describe("Only tasks in this cycle (sprint) number."),
   label: labelField.optional().describe("Only tasks carrying this label."),
-  file_id: z39.uuid().optional().describe("Only tasks from this tasks.md (its spec file id)."),
-  include_details: z39.boolean().optional().describe(
+  file_id: z40.uuid().optional().describe("Only tasks from this tasks.md (its spec file id)."),
+  include_details: z40.boolean().optional().describe(
     "Also return each task's details (its sub-bullets in tasks.md), previewed to 500 characters. Off by default: they make the result several times larger."
   ),
-  limit: z39.number().int().min(1).max(LIST_MAX_TASKS).optional().describe(
+  limit: z40.number().int().min(1).max(LIST_MAX_TASKS).optional().describe(
     `Tasks per page (default ${String(LIST_DEFAULT_TASKS)}, at most ${String(LIST_MAX_TASKS)}).`
   ),
-  offset: z39.number().int().min(0).max(LIST_MAX_OFFSET).optional().describe("How many matching tasks to skip; pass next_offset from the previous page.")
+  offset: z40.number().int().min(0).max(LIST_MAX_OFFSET).optional().describe("How many matching tasks to skip; pass next_offset from the previous page.")
 };
 function pageLocally(board, query) {
   const assignee = query.assigneeUserId;
@@ -7678,7 +7800,7 @@ var listTasksTool = {
   }
 };
 var assigneesInputSchema = {
-  project_id: z39.uuid().describe("UUID of the project whose tasks are being assigned.")
+  project_id: z40.uuid().describe("UUID of the project whose tasks are being assigned.")
 };
 var listTaskAssigneesTool = {
   name: "list_task_assignees",
@@ -7699,29 +7821,29 @@ var listTaskAssigneesTool = {
   }
 };
 var updateInputSchema2 = {
-  project_id: z39.uuid().describe("UUID of the project the tasks belong to."),
+  project_id: z40.uuid().describe("UUID of the project the tasks belong to."),
   task_ids: taskIdsField("The tasks to change (task_id values from list_tasks)."),
   assignee_user_id: userIdField.nullable().optional().describe(
     'User id to assign ("me" for yourself), or null to unassign. The person must be a member of the organisation who can open the project: list_task_assignees lists them.'
   ),
-  priority: z39.number().int().min(0).max(4).optional().describe("0 none, 1 urgent, 2 high, 3 medium, 4 low."),
-  story_points: z39.number().min(0).max(TASK_LIMITS.maxStoryPoints).nullable().optional().describe("Estimate in story points, or null to clear it."),
-  cycle: z39.number().int().min(1).max(TASK_LIMITS.maxCycle).nullable().optional().describe("Cycle (sprint) number, or null to clear it."),
-  start_date: z39.iso.date().nullable().optional().describe("Start day as YYYY-MM-DD, or null to clear it."),
-  end_date: z39.iso.date().nullable().optional().describe("Due day as YYYY-MM-DD, or null to clear it. Not before the start day."),
-  add_labels: z39.array(labelField).max(TASK_LIMITS.maxLabels).optional().describe(`Labels to add. A task carries at most ${String(TASK_LIMITS.maxLabels)}.`),
-  remove_labels: z39.array(labelField).max(TASK_LIMITS.maxLabels).optional().describe("Labels to remove."),
-  add_relationships: z39.array(
-    z39.object({
+  priority: z40.number().int().min(0).max(4).optional().describe("0 none, 1 urgent, 2 high, 3 medium, 4 low."),
+  story_points: z40.number().min(0).max(TASK_LIMITS.maxStoryPoints).nullable().optional().describe("Estimate in story points, or null to clear it."),
+  cycle: z40.number().int().min(1).max(TASK_LIMITS.maxCycle).nullable().optional().describe("Cycle (sprint) number, or null to clear it."),
+  start_date: z40.iso.date().nullable().optional().describe("Start day as YYYY-MM-DD, or null to clear it."),
+  end_date: z40.iso.date().nullable().optional().describe("Due day as YYYY-MM-DD, or null to clear it. Not before the start day."),
+  add_labels: z40.array(labelField).max(TASK_LIMITS.maxLabels).optional().describe(`Labels to add. A task carries at most ${String(TASK_LIMITS.maxLabels)}.`),
+  remove_labels: z40.array(labelField).max(TASK_LIMITS.maxLabels).optional().describe("Labels to remove."),
+  add_relationships: z40.array(
+    z40.object({
       type: RELATIONSHIP_TYPE.describe(
         "How each changed task stands to task_id: blocks (task_id waits for it), blocked_by (it waits for task_id) or related."
       ),
-      task_id: z39.uuid().describe("The other task (a task_id from list_tasks).")
+      task_id: z40.uuid().describe("The other task (a task_id from list_tasks).")
     })
   ).max(TASK_LIMITS.maxRelationships).optional().describe(
     `Relationships to set. Two tasks have at most one: setting one replaces whatever the pair had, and the other task sees the inverse (A blocks B is B blocked_by A). A task has at most ${String(TASK_LIMITS.maxRelationships)}.`
   ),
-  remove_relationships: z39.array(z39.uuid()).max(TASK_LIMITS.maxRelationships).optional().describe("Task ids to unlink each changed task from, whatever the relationship.")
+  remove_relationships: z40.array(z40.uuid()).max(TASK_LIMITS.maxRelationships).optional().describe("Task ids to unlink each changed task from, whatever the relationship.")
 };
 var updateTasksTool = {
   name: "update_tasks",
@@ -7764,13 +7886,13 @@ var updateTasksTool = {
   }
 };
 var statusInputSchema = {
-  project_id: z39.uuid().describe("UUID of the project the tasks belong to."),
+  project_id: z40.uuid().describe("UUID of the project the tasks belong to."),
   task_ids: taskIdsField("The tasks to move (task_id values from list_tasks)."),
   status: STATUS.describe("The new status: pending, in_progress or done."),
-  expected_versions: z39.array(
-    z39.object({
-      spec_file_id: z39.uuid().describe("A tasks.md file (spec_file_id from list_tasks)."),
-      content_version: z39.number().int().min(0).describe("The content_version list_tasks returned for that file.")
+  expected_versions: z40.array(
+    z40.object({
+      spec_file_id: z40.uuid().describe("A tasks.md file (spec_file_id from list_tasks)."),
+      content_version: z40.number().int().min(0).describe("The content_version list_tasks returned for that file.")
     })
   ).max(TASK_LIMITS.maxBoardFiles).optional().describe(
     "Optional. The file versions your view of these tasks came from (from list_tasks); only the files these tasks are in are checked, so passing just those is enough. A file that has changed since is not written and its tasks fail with file_changed, so a change never lands on a line you did not see; list again and retry."
@@ -7839,6 +7961,7 @@ function buildServer(deps) {
   registerTool(server, uploadSpecFileTool, ctx);
   registerTool(server, updateSpecFileTool, ctx);
   registerTool(server, moveSpecFileToTrashTool, ctx);
+  registerTool(server, moveSpecFolderTool, ctx);
   registerTool(server, restoreSpecFileFromTrashTool, ctx);
   registerTool(server, listAttachmentsTool, ctx);
   registerTool(server, readAttachmentTool, ctx);
@@ -8043,7 +8166,7 @@ async function canonicaliseRoot(root) {
 import { promises as fs4 } from "fs";
 import { join as join2, relative } from "path";
 import { spawn } from "child_process";
-import { z as z40 } from "zod";
+import { z as z41 } from "zod";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 
 // src/reverse/ignore.ts
@@ -8348,37 +8471,37 @@ var READ_FILE_MAX_LINES = 2e3;
 var LIST_DIR_HARD_CAP = 5e3;
 var LIST_DIR_DEFAULT_CAP = 1e3;
 var GREP_MAX_MATCHES_DEFAULT = 200;
-var listDirInput = z40.object({
-  path: z40.string(),
-  recursive: z40.boolean().optional(),
-  maxEntries: z40.number().int().positive().optional(),
-  includeIgnored: z40.boolean().optional()
+var listDirInput = z41.object({
+  path: z41.string(),
+  recursive: z41.boolean().optional(),
+  maxEntries: z41.number().int().positive().optional(),
+  includeIgnored: z41.boolean().optional()
 });
-var readFileInput = z40.object({
-  path: z40.string(),
-  offset: z40.number().int().nonnegative().optional(),
-  limit: z40.number().int().positive().optional(),
-  includeIgnored: z40.boolean().optional()
+var readFileInput = z41.object({
+  path: z41.string(),
+  offset: z41.number().int().nonnegative().optional(),
+  limit: z41.number().int().positive().optional(),
+  includeIgnored: z41.boolean().optional()
 });
-var grepInput = z40.object({
-  pattern: z40.string().describe(
+var grepInput = z41.object({
+  pattern: z41.string().describe(
     "Search pattern. Interpreted as a regular expression by default (ripgrep syntax), e.g. `foo|bar` or `[Rr]ole`. Set `isRegex: false` to match the pattern as an exact literal string instead."
   ),
-  path: z40.string().optional().describe("File or directory under --root to search. Defaults to the whole root."),
-  isRegex: z40.boolean().optional().describe("Treat `pattern` as a regex (default true). Set false for literal-string search."),
-  caseSensitive: z40.boolean().optional(),
-  maxMatches: z40.number().int().positive().optional(),
-  contextLines: z40.number().int().nonnegative().optional(),
-  includeIgnored: z40.boolean().optional()
+  path: z41.string().optional().describe("File or directory under --root to search. Defaults to the whole root."),
+  isRegex: z41.boolean().optional().describe("Treat `pattern` as a regex (default true). Set false for literal-string search."),
+  caseSensitive: z41.boolean().optional(),
+  maxMatches: z41.number().int().positive().optional(),
+  contextLines: z41.number().int().nonnegative().optional(),
+  includeIgnored: z41.boolean().optional()
 });
-var packCodebaseInput = z40.object({
-  subpath: z40.string().optional(),
-  includePatterns: z40.string().optional(),
-  ignorePatterns: z40.string().optional()
+var packCodebaseInput = z41.object({
+  subpath: z41.string().optional(),
+  includePatterns: z41.string().optional(),
+  ignorePatterns: z41.string().optional()
 });
-var packCodebaseReadPageInput = z40.object({
-  outputId: z40.string(),
-  page: z40.number().int().positive()
+var packCodebaseReadPageInput = z41.object({
+  outputId: z41.string(),
+  page: z41.number().int().positive()
 });
 function structuredError(error, message, extra) {
   const payload = { error, message, ...extra ?? {} };
@@ -8906,7 +9029,7 @@ function jsonSchemaFromZod(schema) {
   return zodToJson(schema);
 }
 function zodToJson(schema) {
-  if (schema instanceof z40.ZodObject) {
+  if (schema instanceof z41.ZodObject) {
     const shape = schema.shape;
     const properties = {};
     const required = [];
@@ -8921,19 +9044,19 @@ function zodToJson(schema) {
     if (required.length > 0) out.required = required;
     return out;
   }
-  if (schema instanceof z40.ZodOptional) {
+  if (schema instanceof z41.ZodOptional) {
     return zodToJson(schema.unwrap());
   }
-  if (schema instanceof z40.ZodString) {
+  if (schema instanceof z41.ZodString) {
     return { type: "string" };
   }
-  if (schema instanceof z40.ZodNumber) {
+  if (schema instanceof z41.ZodNumber) {
     return { type: "number" };
   }
-  if (schema instanceof z40.ZodBoolean) {
+  if (schema instanceof z41.ZodBoolean) {
     return { type: "boolean" };
   }
-  if (schema instanceof z40.ZodEnum) {
+  if (schema instanceof z41.ZodEnum) {
     return { type: "string", enum: schema.options };
   }
   return { type: "string" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myspec/mcp-server",
-  "version": "1.1.1-next.176",
+  "version": "1.1.2-next.178",
   "description": "MySpec MCP server — exposes MySpec platform projects, files and attachments to MCP-aware clients via OAuth-authenticated access tokens.",
   "type": "module",
   "repository": {