@pikku/cli 0.12.155 → 0.12.159

package/dist/.pikku/scenarios/schemas/register.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 export const empty = null;

package/dist/.pikku/scheduler/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/scheduler` resolves here.

package/dist/.pikku/scheduler/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/scheduler` resolves here.

package/dist/.pikku/scheduler/pikku-scheduler-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Scheduler-specific type definitions for tree-shaking optimization

package/dist/.pikku/scheduler/pikku-scheduler-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Scheduler-specific type definitions for tree-shaking optimization

package/dist/.pikku/schemas/register.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 import { addSchema } from '@pikku/core/schema';
 import * as BinaryInput from './schemas/BinaryInput.schema.json' with { type: 'json' };

package/dist/.pikku/schemas/schemas/FabricChangesAskInput.schema.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "apiUrl": { "type": "string" }, "changeId": { "type": "string" }, "question": { "type": "string", "minLength": 1 }, "authorName": { "type": "string" } }, "required": ["changeId", "question"], "additionalProperties": false }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "apiUrl": { "type": "string" }, "changeId": { "type": "string" }, "question": { "type": "string", "minLength": 1 }, "option": { "maxItems": 6, "type": "array", "items": { "type": "string", "minLength": 1 } }, "authorName": { "type": "string" } }, "required": ["changeId", "question"], "additionalProperties": false }

package/dist/.pikku/schemas/schemas/FabricInitInput.schema.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "repo": { "type": "string" }, "name": { "type": "string" }, "branch": { "type": "string" }, "force": { "type": "boolean" }, "apiUrl": { "type": "string" } }, "required": ["repo"], "additionalProperties": false }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "repo": { "type": "string" }, "name": { "type": "string" }, "branch": { "type": "string" }, "force": { "type": "boolean" }, "apiUrl": { "type": "string" }, "organization": { "type": "string" } }, "required": ["repo"], "additionalProperties": false }

package/dist/.pikku/schemas/schemas/FabricLinkInput.schema.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "apiUrl": { "type": "string" }, "github": { "type": "boolean" }, "gitea": { "type": "boolean" }, "repoName": { "type": "string" } }, "additionalProperties": false }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "apiUrl": { "type": "string" }, "github": { "type": "boolean" }, "gitea": { "type": "boolean" }, "repoName": { "type": "string" }, "organization": { "type": "string" } }, "additionalProperties": false }

package/dist/.pikku/schemas/schemas/KnowledgeReconcileInput.schema.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": {}, "additionalProperties": false }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "require": { "type": "string" } }, "additionalProperties": false }

package/dist/.pikku/schemas/schemas/KnowledgeReconcileOutput.schema.json

@@ -1 +1 @@
-{ "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "kind": { "type": "string", "enum": ["idle", "repair-note", "write-plan", "ask-user", "dispatch", "hold"] }, "reason": { "type": "string" }, "note": { "type": "string" }, "hold": { "type": "string" }, "notes": { "type": "array", "items": { "type": "string" } }, "question": { "type": "object", "properties": { "header": { "type": "string" }, "question": { "type": "string" }, "options": { "default": [], "type": "array", "items": { "type": "object", "properties": { "label": { "type": "string" }, "description": { "type": "string" } }, "required": ["label"], "additionalProperties": false } } }, "required": ["header", "question", "options"], "additionalProperties": false } }, "required": ["kind", "reason"], "additionalProperties": false }
+{ "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "kind": { "type": "string", "enum": ["idle", "repair-note", "write-plan", "ask-user", "dispatch", "hold"] }, "reason": { "type": "string" }, "note": { "type": "string" }, "hold": { "type": "string" }, "notes": { "type": "array", "items": { "type": "string" } }, "question": { "type": "object", "properties": { "header": { "type": "string" }, "question": { "type": "string" }, "options": { "default": [], "type": "array", "items": { "type": "object", "properties": { "label": { "type": "string" }, "description": { "type": "string" } }, "required": ["label"], "additionalProperties": false } } }, "required": ["header", "question", "options"], "additionalProperties": false }, "satisfied": { "type": "boolean" }, "required": { "type": "array", "items": { "type": "string" } } }, "required": ["kind", "reason"], "additionalProperties": false }

package/dist/.pikku/schemas/schemas/PikkuSkillsInstallInput.schema.json

@@ -1 +1 @@
-{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "agent": { "type": "string" }, "only": { "type": "string" }, "core": { "type": "boolean" }, "fabric": { "type": "boolean" }, "client": { "type": "boolean" }, "update": { "type": "boolean" } }, "additionalProperties": false, "definitions": {} }
+{ "$schema": "http://json-schema.org/draft-07/schema#", "type": "object", "properties": { "agent": { "type": "string" }, "only": { "type": "string" }, "core": { "type": "boolean" }, "fabric": { "type": "boolean" }, "client": { "type": "boolean" }, "update": { "type": "boolean" }, "agentExtensions": { "type": "string" }, "agentDir": { "type": "string" }, "agentSkillDir": { "type": "string" } }, "additionalProperties": false, "definitions": {} }

package/dist/.pikku/scopes/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/scopes` resolves here.

package/dist/.pikku/scopes/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/scopes` resolves here.

package/dist/.pikku/scopes/pikku-flags.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * This file was generated by the @pikku/cli

package/dist/.pikku/scopes/pikku-personas.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * This file was generated by the @pikku/cli

package/dist/.pikku/scopes/pikku-roles.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * This file was generated by the @pikku/cli

package/dist/.pikku/scopes/pikku-scope-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 export { defineScope } from '@pikku/core/scope';
 export { defineSystemRole } from '@pikku/core/role';

package/dist/.pikku/scopes/pikku-scope-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 export { defineScope } from '@pikku/core/scope';
 export { defineSystemRole } from '@pikku/core/role';

package/dist/.pikku/scopes/pikku-scopes.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * This file was generated by the @pikku/cli

package/dist/.pikku/secrets/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/secrets` resolves here.

package/dist/.pikku/secrets/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/secrets` resolves here.

package/dist/.pikku/secrets/pikku-secret-types.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 export { defineSecret } from '@pikku/core/secret';

package/dist/.pikku/secrets/pikku-secret-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 export { defineSecret } from '@pikku/core/secret';

package/dist/.pikku/secrets/pikku-secrets.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 import type { SecretService } from '@pikku/core/services';

package/dist/.pikku/secrets/pikku-secrets.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 /**

package/dist/.pikku/services/pikku-meta-service.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 import { LocalMetaService } from '@pikku/core/services/local-meta';
 export declare class PikkuMetaService extends LocalMetaService {

package/dist/.pikku/services/pikku-meta-service.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 import { LocalMetaService } from '@pikku/core/services/local-meta';
 export class PikkuMetaService extends LocalMetaService {

package/dist/.pikku/setup/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/setup` resolves here.

package/dist/.pikku/setup/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/setup` resolves here.

package/dist/.pikku/setup/pikku-setup-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Config and service factory definitions, declared once per application

package/dist/.pikku/setup/pikku-setup-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Config and service factory definitions, declared once per application

package/dist/.pikku/trigger/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/trigger` resolves here.

package/dist/.pikku/trigger/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/trigger` resolves here.

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/variables/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/variables` resolves here.

package/dist/.pikku/variables/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/variables` resolves here.

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 import { TypedVariablesService as CoreTypedVariablesService, } from '@pikku/core/services';
 /**

package/dist/.pikku/workflow/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import type { PikkuWorkflowGraphConfig, PikkuWorkflowGraphResult } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { pikkuWorkflowGraph as corePikkuWorkflowGraph } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 import { pikkuState } from '@pikku/core/state';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.155
+ * This file was generated by @pikku/cli@0.12.159
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.155') {
-      process.stderr.write(`\n  Update available  0.12.155 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.159') {
+      process.stderr.write(`\n  Update available  0.12.159 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }
@@ -20,4 +20,4 @@ import { PikkuCLI } from '../.pikku/cli/pikku-cli.gen.js'
 const updateCheck = checkForUpdate()
 await PikkuCLI(process.argv.slice(2))
 await updateCheck
-process.exit(0)
+process.exit(process.exitCode ?? 0)

package/dist/src/cli.wiring.js

@@ -581,6 +581,12 @@ wireCLI({
                     func: knowledgeReconcile,
                     render: renderKnowledgeReconcile,
                     description: 'Say the one thing to do next — repair a note, write a plan, ask the user, build, or nothing',
+                    options: {
+                        require: {
+                            description: 'Exit non-zero unless the next action is one of these (comma-separated: idle, repair-note, write-plan, ask-user, dispatch, hold) — what turns this command into a gate a stage can be held to',
+                            type: 'string',
+                        },
+                    },
                 }),
                 plan: {
                     description: "Read and write a milestone's technical plan — the shape of the work, checked before it is built rather than after",
@@ -666,7 +672,7 @@ wireCLI({
                             default: 'default',
                         },
                         strict: {
-                            description: 'Fail rather than pass a `then` that has no witness for --run, i.e. an assertion nobody checked on the surface its prose claims',
+                            description: 'Every step must run on --run: an action may not fall back to its default binding, and a `then` may not be witnessed anywhere else. No effect on --run default',
                             default: false,
                         },
                         spawn: {
@@ -1100,6 +1106,18 @@ wireCLI({
                             description: 'Overwrite existing skills if already installed',
                             default: false,
                         },
+                        agentExtensions: {
+                            description: 'Comma-separated extension paths every projected agent loads — how a host that fences its writers or routes their model adds that to the agents it installs',
+                            type: 'string',
+                        },
+                        agentDir: {
+                            description: 'Where to write the projected agents, overriding the harness default — an absolute path for a host whose agents live outside the project',
+                            type: 'string',
+                        },
+                        agentSkillDir: {
+                            description: 'The skill directory a projected agent points at, for a host that relocates the installed skills afterwards',
+                            type: 'string',
+                        },
                     },
                 }),
             },

package/dist/src/deploy/analyzer/analyzer.js

@@ -10,7 +10,56 @@ import { incompatibleServicesFor, resolveDeployTarget, } from '@pikku/inspector'
 import { relative } from 'node:path';
 import { isScenarioFunction, withoutScenarios, withoutScenarioWorkflows, } from '../../functions/wirings/scenarios/scenario-partition.js';
 import { toSafeKebab } from './naming.js';
+import { mcpSurfaceSlug } from '../../utils/mcp-surface.js';
 import { createUnitResolver } from './grouping.js';
+/**
+ * Where an MCP unit answers. Every runtime that mounts MCP defaults to `/mcp`,
+ * and pikku's own codegen never writes an `mcpPath` into the generated
+ * manifest, so the route table and the mount agree. A project that overrides
+ * `mcpPath` in `mcp.gen.json` moves the mount but not this — the analyzer never
+ * reads that file.
+ */
+const MCP_PATH = '/mcp';
+/** The discovery document `PikkuMCPServer` serves, per RFC 9728. */
+const WELL_KNOWN_PRM = '/.well-known/oauth-protected-resource';
+/**
+ * The routes an MCP unit has to receive to serve Streamable HTTP. Without them
+ * the unit deploys with an empty route table and nothing ever reaches it: POST
+ * carries the JSON-RPC calls, GET opens the server-to-client stream, and DELETE
+ * ends a session. The well-known paths are how a client discovers the
+ * authorization server when the endpoint refuses it.
+ *
+ * `bareDiscovery` is what keeps a multi-endpoint project's route table
+ * unambiguous. RFC 9728 folds the resource's path into the well-known route, so
+ * each endpoint's own document is distinct, but the bare path predates that and
+ * describes whichever resource answers it. Handing it to every unit would
+ * register the same route twice and let the router pick a winner, so only the
+ * project's default endpoint claims it; a surface serves its path-aware
+ * document alone.
+ *
+ * The ids are synthetic, as they are for the agent gateway's routes: no single
+ * pikku function answers here, because the MCP transport picks the tool out of
+ * the JSON-RPC body and dispatches it itself.
+ */
+const mcpRoutes = (mcpPath, { bareDiscovery = true } = {}) => [
+    { method: 'post', route: mcpPath, pikkuFuncId: 'mcp:call' },
+    { method: 'get', route: mcpPath, pikkuFuncId: 'mcp:stream' },
+    { method: 'delete', route: mcpPath, pikkuFuncId: 'mcp:end' },
+    ...(bareDiscovery
+        ? [
+            {
+                method: 'get',
+                route: WELL_KNOWN_PRM,
+                pikkuFuncId: 'mcp:discovery',
+            },
+        ]
+        : []),
+    {
+        method: 'get',
+        route: `${WELL_KNOWN_PRM}${mcpPath}`,
+        pikkuFuncId: 'mcp:discovery',
+    },
+];
 export function analyzeDeployment(state, options) {
     const serverlessIncompatible = new Set(options.serverlessIncompatible ?? []);
     const defaultTarget = options.defaultTarget ?? 'serverless';
@@ -370,9 +419,25 @@ export function analyzeDeployment(state, options) {
     // place a scenario or step id can still arrive from raw state. A gateway that
     // lists one would depend on a unit that was never emitted.
     const deployableFuncId = (funcId) => !isScenarioFunction(state.functions.meta[funcId]);
-    const mcpToolIds = values(state.mcpEndpoints.toolsMeta)
-        .map((t) => t.pikkuFuncId)
-        .filter(deployableFuncId);
+    // A tool naming a surface is served by that surface's endpoint and by no
+    // other, so it is grouped out of the default set here rather than pooled
+    // with it. Resources and prompts have no surface of their own yet.
+    const surfacePaths = state.mcpEndpoints.surfaces ?? {};
+    const toolIdsBySurface = new Map();
+    const mcpToolIds = [];
+    for (const tool of values(state.mcpEndpoints.toolsMeta)) {
+        if (!deployableFuncId(tool.pikkuFuncId))
+            continue;
+        const surface = tool.surface;
+        if (surface && surfacePaths[surface]) {
+            const ids = toolIdsBySurface.get(surface) ?? [];
+            ids.push(tool.pikkuFuncId);
+            toolIdsBySurface.set(surface, ids);
+        }
+        else {
+            mcpToolIds.push(tool.pikkuFuncId);
+        }
+    }
     const mcpResourceIds = values(state.mcpEndpoints.resourcesMeta)
         .map((r) => r.pikkuFuncId)
         .filter(deployableFuncId);
@@ -388,6 +453,30 @@ export function analyzeDeployment(state, options) {
             mcpToolIds.push(funcId);
         }
     }
+    for (const [surface, toolIds] of toolIdsBySurface) {
+        const unitName = `mcp-${mcpSurfaceSlug(surface)}`;
+        units.push({
+            name: unitName,
+            role: 'mcp',
+            target: 'serverless',
+            functionIds: [],
+            services: [],
+            dependsOn: toolIds.map((id) => unitFor(id)),
+            handlers: [
+                {
+                    type: 'fetch',
+                    routes: mcpRoutes(surfacePaths[surface], { bareDiscovery: false }),
+                },
+            ],
+            tags: collectTags(toolIds, tagsFor),
+        });
+        mcpEndpoints.push({
+            unitName,
+            toolFunctionIds: toolIds,
+            resourceFunctionIds: [],
+            promptFunctionIds: [],
+        });
+    }
     const allMcpIds = [...mcpToolIds, ...mcpResourceIds, ...mcpPromptIds];
     if (allMcpIds.length > 0) {
         const unitName = 'mcp-server';
@@ -399,7 +488,7 @@ export function analyzeDeployment(state, options) {
             functionIds: [], // No function code bundled
             services: [],
             dependsOn: mcpFuncUnitNames,
-            handlers: [{ type: 'fetch', routes: [] }],
+            handlers: [{ type: 'fetch', routes: mcpRoutes(MCP_PATH) }],
             tags: collectTags(allMcpIds, tagsFor),
         });
         mcpEndpoints.push({

package/dist/src/deploy/codegen/per-unit-codegen.js

@@ -99,6 +99,30 @@ export function collectFilterNames(unit, manifest, inspectorState, workflowQueue
                 for (const id of channelDef.functionIds)
                     names.add(id);
             }
+            // A CLI channel is a whole program's transport, not a set of commands.
+            //
+            // `wireCLI` generates this channel and tags it ['cli', <program>]. Its
+            // own wirings are the per-command ones plus `__help` and `__raw`, and
+            // those two resolve against `CLIMeta.programs[<program>]` rather than
+            // against a wiring — so without the program the channel connects, serves
+            // a named command, and answers `__help` with "Program not found".
+            //
+            // CLI programs are filtered by COMMAND name (see the inspector's
+            // filter-inspector-state), and a command name matches nothing in the set
+            // above, so every command is dropped and the empty program with it. The
+            // program's commands are what has to be asked for.
+            if (unit.tags.includes('cli')) {
+                const programs = inspectorState.cli?.meta?.programs ?? {};
+                for (const tag of unit.tags) {
+                    const programMeta = programs[tag];
+                    if (!programMeta)
+                        continue;
+                    names.add(tag);
+                    for (const commandName of Object.keys(programMeta.commands ?? {})) {
+                        names.add(commandName);
+                    }
+                }
+            }
             break;
         }
         case 'function': {