@planu/cli 4.14.1 → 5.0.0

package/dist/tools/tool-registry/core-tools.js

@@ -19,6 +19,7 @@ import { handleGenerateDiagram } from '../diagram-handler.js';
 import { handleCheckParallelSafety } from '../parallel-safety-handler.js';
 import { handleAnalyzePerformanceImpact } from '../performance-analysis-handler.js';
 import { handlePlanStatus } from '../status-handler.js';
+import { handleSessionCheckpoint } from '../session-checkpoint.js';
 import { handleValidateWorkflow } from '../validate-workflow.js';
 import { handleTransformCode } from '../transform-code-handler.js';
 import { handleConfigureTelemetry } from '../configure-telemetry.js';
@@ -47,6 +48,21 @@ import { handleStorageExport, handleStorageImport } from '../storage-bundle-hand
 import { handleCancelJob, handleGetJob, handleRestartJob, handleWatchJob, } from '../jobs/handlers.js';
 // ── Registry ─────────────────────────────────────────────────────────────────
 const coreToolsRegistry = [
+    {
+        name: 'session_checkpoint',
+        description: 'Persist a compact, bounded session checkpoint to planu/session-context.md for the next session.',
+        schema: {
+            projectPath: z.string().trim().min(1).max(4096),
+        },
+        handler: handleSessionCheckpoint,
+        annotations: {
+            title: 'Session Checkpoint',
+            readOnlyHint: false,
+            destructiveHint: false,
+        },
+        wrap: 'safe',
+        group: 'core',
+    },
     {
         name: 'get_job',
         description: 'Read the durable state and latest checkpoint or result for a local Planu job.',
@@ -237,7 +253,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleGenerateDiagram(args),
         annotations: { readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'analysis',
     },
     // ── check_parallel_safety (SPEC-373) ──────────────────────────────────────
@@ -254,7 +270,7 @@ const coreToolsRegistry = [
         },
         handler: (args) => Promise.resolve(handleCheckParallelSafety(args)),
         annotations: { title: 'Check Parallel Safety', readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'analysis',
     },
     // ── analyze_performance_impact (SPEC-300) ─────────────────────────────────
@@ -276,7 +292,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleAnalyzePerformanceImpact(args),
         annotations: { readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'analysis',
     },
     // ── planu_status (SPEC-223) ───────────────────────────────────────────────
@@ -329,7 +345,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleValidateWorkflow(args),
         annotations: { readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'core',
     },
     // ── transform_code (SPEC-077) ─────────────────────────────────────────────
@@ -354,7 +370,7 @@ const coreToolsRegistry = [
         },
         handler: (args) => Promise.resolve(handleTransformCode(args)),
         annotations: { title: 'Transform Code', readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'core',
     },
     // ── configure_telemetry (SPEC-200) ────────────────────────────────────────
@@ -403,7 +419,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleTelemetryHealth(args),
         annotations: { title: 'Telemetry Health', readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'core',
     },
     // ── configure_observability (SPEC-165) ────────────────────────────────────
@@ -496,7 +512,7 @@ const coreToolsRegistry = [
         },
         handler: (args) => Promise.resolve(handleRecommendModel(args)),
         annotations: { title: 'Recommend Model', readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'analysis',
     },
     // ── export_spec (SPEC-097) ────────────────────────────────────────────────
@@ -524,7 +540,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleExportSpec(args),
         annotations: { readOnlyHint: false },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'spec',
     },
     // ── decompose_spec (SPEC-157) ─────────────────────────────────────────────
@@ -556,7 +572,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleDecomposeSpec(args),
         annotations: { readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'spec',
     },
     // ── facilitate (SPEC-037 + SPEC-264) ──────────────────────────────────────
@@ -688,7 +704,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleScanProject(args),
         annotations: { readOnlyHint: false },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'analysis',
     },
     // ── estimate_ai_cost (SPEC-069) ───────────────────────────────────────────
@@ -710,7 +726,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleEstimateAiCost(args),
         annotations: { title: 'Estimate AI Cost', readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'analysis',
     },
     // ── heal_spec_docs (SPEC-493) ─────────────────────────────────────────────
@@ -738,7 +754,7 @@ const coreToolsRegistry = [
             readOnlyHint: false,
             destructiveHint: false,
         },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'spec',
     },
     // ── convert_to_bdd (SPEC-481) ─────────────────────────────────────────────
@@ -810,7 +826,7 @@ const coreToolsRegistry = [
         },
         handler: (args) => Promise.resolve(handleIdeConfig(args)),
         annotations: { title: 'Generate IDE Config' },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'core',
     },
     // ── living_reconcile_spec (SPEC-330) ──────────────────────────────────────
@@ -833,7 +849,7 @@ const coreToolsRegistry = [
             readOnlyHint: false,
             destructiveHint: false,
         },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'spec',
     },
     // ── security_report (SPEC-084) ────────────────────────────────────────────
@@ -847,7 +863,7 @@ const coreToolsRegistry = [
         },
         handler: (args) => Promise.resolve(handleSecurityReport(args)),
         annotations: { readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'core',
     },
     // ── render_spec_for_provider (SPEC-670) ───────────────────────────────────

package/dist/tools/tool-registry/group-infra.js

@@ -1,11 +1,8 @@
 import { technologyValue } from '../../engine/technology-registry.js';
 import { z } from 'zod';
 // ── safe handlers ────────────────────────────────────────────────────────────
-import { safe, safeLicensed, safeTracked } from '../safe-handler.js';
-// ── License tools (register-license-tools.ts) ───────────────────────────────
-import { handleActivateLicense, handleDeactivateLicense } from '../activate-license.js';
-import { handleLicenseStatus } from '../license-status.js';
-import { LicenseStatusOutputSchema, SpecIdSchema } from '../schemas/index.js';
+import { safe, safeGoverned, safeTracked } from '../safe-handler.js';
+import { SpecIdSchema } from '../schemas/index.js';
 // ── OAuth tools (register-oauth-tools.ts / register-configure-oauth-tool.ts) ─
 import { handleStartOAuthFlow, handleOAuthStatus, StartOAuthFlowInputSchema, OAuthStatusInputSchema, } from '../oauth-handler.js';
 import { handleConfigureOAuth } from '../configure-oauth-handler.js';
@@ -13,8 +10,6 @@ import { handleConfigureOAuth } from '../configure-oauth-handler.js';
 import { handleUsageStats } from '../usage-stats.js';
 import { handleUsageReport } from '../usage-report.js';
 import { handleToolUsageReport } from '../tool-usage-report.js';
-// ── Webhook tools (register-webhook-tools.ts) ────────────────────────────────
-import { handleStartWebhook, handleStopWebhook, handleWebhookStatus } from '../webhook.js';
 // ── Outbound webhook tools (register-outbound-webhook-tools.ts) ──────────────
 import { handleConfigureWebhook, handleOutboundWebhookStatus, handleRemoveWebhook, } from '../outbound-webhook-handler.js';
 // ── Dashboard tools (register-dashboard-tools.ts) ────────────────────────────
@@ -90,56 +85,17 @@ const deployProviderEnum = z
 ])
     .describe('Deploy provider: vercel | netlify | cloudflare-pages | fly | railway');
 export function registerInfraGroupTools(server) {
-    // ── License tools ──────────────────────────────────────────────────────────
-    server.registerTool('activate_license', {
-        description: 'Activate a Planu license key to unlock Pro/Team/Enterprise features. ' +
-            'Get your key at https://planu.dev/pricing.',
-        inputSchema: {
-            licenseKey: z
-                .string()
-                .max(500)
-                .describe('License key from Lemon Squeezy (e.g. XXXXXXXX-XXXX-...)'),
-            instanceName: z
-                .string()
-                .max(500)
-                .optional()
-                .describe('Optional name for this machine (defaults to hostname)'),
-        },
-        annotations: { title: 'Activate License', readOnlyHint: false },
-    }, safe(async (args) => handleActivateLicense(args)));
-    server.registerTool('deactivate_license', {
-        description: 'Deactivate your Planu license on this machine. ' +
-            'Frees up the activation slot so you can use it elsewhere.',
-        inputSchema: {
-            confirm: z
-                .boolean()
-                .describe('Set to true to confirm deactivation. This reverts to the Free plan.'),
-        },
-        annotations: { title: 'Deactivate License', destructiveHint: true },
-    }, safe(async (args) => handleDeactivateLicense(args)));
-    server.registerTool('license_status', {
-        description: 'Show your current Planu plan, limits, usage, and upgrade options.',
-        inputSchema: {
-            projectId: z
-                .string()
-                .max(500)
-                .optional()
-                .describe('Optional project ID to include project-specific usage'),
-        },
-        outputSchema: LicenseStatusOutputSchema,
-        annotations: { title: 'License Status', readOnlyHint: true },
-    }, safe(async (args) => handleLicenseStatus(args)));
     // ── OAuth tools ────────────────────────────────────────────────────────────
     server.registerTool('start_oauth_flow', {
         description: 'Start guided OAuth setup for supported integrations such as Figma, GitHub, Sentry, or Supabase.',
         inputSchema: StartOAuthFlowInputSchema,
         annotations: { title: 'Start OAuth Flow', readOnlyHint: false },
-    }, safeLicensed('start_oauth_flow', async (args) => handleStartOAuthFlow(args)));
+    }, safeGoverned('start_oauth_flow', async (args) => handleStartOAuthFlow(args)));
     server.registerTool('oauth_status', {
         description: 'Show which OAuth-backed integrations are connected for this project.',
         inputSchema: OAuthStatusInputSchema,
         annotations: { title: 'OAuth Status', readOnlyHint: true },
-    }, safeLicensed('oauth_status', async (args) => handleOAuthStatus(args)));
+    }, safeGoverned('oauth_status', async (args) => handleOAuthStatus(args)));
     server.registerTool('configure_oauth', {
         description: 'Inspect Planu MCP OAuth/API-key auth status or test a bearer token without exposing secrets.',
         inputSchema: {
@@ -150,7 +106,7 @@ export function registerInfraGroupTools(server) {
     }, safe(async (args) => handleConfigureOAuth(args)));
     // ── Usage tools ────────────────────────────────────────────────────────────
     server.registerTool('usage_stats', {
-        description: 'View your Planu usage statistics — tool calls, top tools, remaining daily calls. ' +
+        description: 'View your Planu usage statistics — tool calls, top tools, and execution health. ' +
             'Helps you understand how much of your plan you are using. ' +
             'For the last 30 days with no parameters prefer resource: planu://usage/stats.',
         inputSchema: {
@@ -193,45 +149,6 @@ export function registerInfraGroupTools(server) {
         },
         annotations: { title: 'Tool Usage Report', readOnlyHint: true },
     }, safe(async (args) => handleToolUsageReport(args)));
-    // ── Webhook tools (inbound) ────────────────────────────────────────────────
-    server.registerTool('start_webhook', {
-        description: 'Start a local HTTP server to receive Lemon Squeezy webhook events. ' +
-            'Configure the server URL in your Lemon Squeezy dashboard under Settings > Webhooks.',
-        inputSchema: {
-            port: z
-                .number()
-                .int()
-                .min(1)
-                .max(65535)
-                .optional()
-                .describe('Port to listen on (default: 2358)'),
-            secret: z
-                .string()
-                .optional()
-                .describe('Webhook secret from Lemon Squeezy dashboard for HMAC-SHA256 signature validation'),
-        },
-        annotations: { title: 'Start Webhook Server', readOnlyHint: false },
-    }, safe((args) => handleStartWebhook(args)));
-    server.registerTool('stop_webhook', {
-        description: 'Stop the running Lemon Squeezy webhook server.',
-        inputSchema: {
-            force: z
-                .boolean()
-                .optional()
-                .describe('Force stop even if events are being processed (default: false)'),
-        },
-        annotations: { title: 'Stop Webhook Server', destructiveHint: false },
-    }, safe((args) => handleStopWebhook(args)));
-    server.registerTool('webhook_status', {
-        description: 'Show whether the webhook server is running and display recently received events.',
-        inputSchema: {
-            includeEvents: z
-                .boolean()
-                .optional()
-                .describe('Include recent event log in the output (default: true)'),
-        },
-        annotations: { title: 'Webhook Status', readOnlyHint: true },
-    }, safe((args) => Promise.resolve(handleWebhookStatus(args))));
     // ── Outbound webhook tools ─────────────────────────────────────────────────
     server.registerTool('configure_webhook', {
         description: 'Register an outbound webhook endpoint to receive Planu spec lifecycle events. ' +
@@ -364,7 +281,7 @@ export function registerInfraGroupTools(server) {
                 .describe('Set to true to apply the pin immediately. Defaults to false (preview only).'),
         },
         annotations: { readOnlyHint: false, destructiveHint: false },
-    }, safeLicensed('pin_version', async (args) => handlePinVersion(args)));
+    }, safeGoverned('pin_version', async (args) => handlePinVersion(args)));
     // ── Deploy tools ────────────────────────────────────────────────────────────
     server.registerTool('configure_deploy_target', {
         description: 'Save credentials for a deploy provider (Vercel, Netlify, etc.). Stores the API token in data/{projectId}/deploy-config.json. Required before deploy_spec.',
@@ -470,7 +387,7 @@ export function registerInfraGroupTools(server) {
                 .describe('Maximum results to return across all projects (default 50)'),
         },
         annotations: { title: 'Search All Projects', readOnlyHint: true },
-    }, safeLicensed('search_all_projects', async (args) => handleSearchAllProjects(args)));
+    }, safeGoverned('search_all_projects', async (args) => handleSearchAllProjects(args)));
     // ── Browser validate tools ─────────────────────────────────────────────────
     server.registerTool('validate_browser', {
         description: 'Extract UI-testable assertions from a spec and run them against a live URL using Playwright. ' +
@@ -516,7 +433,7 @@ export function registerInfraGroupTools(server) {
             value: ConfigureWorkersInputSchema.shape.value,
         },
         annotations: { title: 'Configure Workers', readOnlyHint: false },
-    }, safeLicensed('configure_workers', (args) => handleConfigureWorkers(args)));
+    }, safeGoverned('configure_workers', (args) => handleConfigureWorkers(args)));
     // ── Plugin tools ───────────────────────────────────────────────────────────
     server.registerTool('manage_plugins', {
         description: 'Manage Planu plugin lifecycle: search, list, activate, deactivate, uninstall, info. ' +
@@ -528,7 +445,7 @@ export function registerInfraGroupTools(server) {
             readOnlyHint: false,
             destructiveHint: false,
         },
-    }, safeLicensed('manage_plugins', async (args) => handleManagePlugins(args)));
+    }, safeGoverned('manage_plugins', async (args) => handleManagePlugins(args)));
     server.registerTool('scaffold_plugin', {
         description: 'Generate a starter plugin project with manifest, entry point, tests, and examples. ' +
             'The scaffold includes TypeScript config and example extensions for the selected types.',
@@ -537,7 +454,7 @@ export function registerInfraGroupTools(server) {
             title: 'Scaffold Plugin',
             readOnlyHint: false,
         },
-    }, safeLicensed('scaffold_plugin', async (args) => handleScaffoldPlugin(args)));
+    }, safeGoverned('scaffold_plugin', async (args) => handleScaffoldPlugin(args)));
     // ── Token optimizer tools ──────────────────────────────────────────────────
     server.registerTool('suggest_token_optimizer', {
         description: 'Detect whether RTK (Response Token Killer) or Headroom are configured in the project. ' +
@@ -546,7 +463,7 @@ export function registerInfraGroupTools(server) {
         inputSchema: {
             projectPath: z.string().describe('Absolute path to the project root directory'),
         },
-    }, safeLicensed('suggest_token_optimizer', async (args) => handleSuggestTokenOptimizer(args)));
+    }, safeGoverned('suggest_token_optimizer', async (args) => handleSuggestTokenOptimizer(args)));
     server.registerTool('token_optimizer_status', {
         description: 'Returns the installation status of RTK and Headroom token optimization tools. ' +
             'Includes version info and number of configured PreToolUse hooks.',
@@ -554,7 +471,7 @@ export function registerInfraGroupTools(server) {
         inputSchema: {
             projectPath: z.string().describe('Absolute path to the project root directory'),
         },
-    }, safeLicensed('token_optimizer_status', async (args) => handleTokenOptimizerStatus(args)));
+    }, safeGoverned('token_optimizer_status', async (args) => handleTokenOptimizerStatus(args)));
     // ── RBAC tools ─────────────────────────────────────────────────────────────
     server.registerTool('configure_roles', {
         description: 'Enable or disable Role-Based Access Control (RBAC) for a project. ' +
@@ -566,7 +483,7 @@ export function registerInfraGroupTools(server) {
             enabled: ConfigureRolesInputSchema.shape.enabled,
         },
         annotations: { title: 'Configure Roles (RBAC)', readOnlyHint: false },
-    }, safeLicensed('configure_roles', (args) => handleConfigureRoles(args)));
+    }, safeGoverned('configure_roles', (args) => handleConfigureRoles(args)));
     server.registerTool('assign_role', {
         description: 'Assign a role to a user for a project or a specific spec. ' +
             'Roles: Admin (full access), Architect (create/approve/configure), ' +
@@ -581,7 +498,7 @@ export function registerInfraGroupTools(server) {
             assignedBy: AssignRoleInputSchema.shape.assignedBy,
         },
         annotations: { title: 'Assign Role', readOnlyHint: false },
-    }, safeLicensed('assign_role', (args) => handleAssignRole(args)));
+    }, safeGoverned('assign_role', (args) => handleAssignRole(args)));
     // ── Framework registry tools ───────────────────────────────────────────────
     server.registerTool('check_spec_accuracy', {
         description: 'Validate spec content (spec.md text or acceptance criteria) against the framework registry ' +
@@ -784,7 +701,7 @@ export function registerInfraGroupTools(server) {
                 .describe('Also audit ~/.claude/ global config (default: true)'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('audit_claude_config', async (args) => handleAuditClaudeConfig(args)));
+    }, safeGoverned('audit_claude_config', async (args) => handleAuditClaudeConfig(args)));
     server.registerTool('generate_docs_site', {
         description: 'Generate a static HTML documentation site from project specs, tools catalog, architecture diagrams, and metrics. ' +
             'Produces a navigable portal with dashboard, spec pages, tools catalog, Mermaid diagrams, and search.',
@@ -797,7 +714,7 @@ export function registerInfraGroupTools(server) {
                 .describe('Site title (default: "Planu Documentation")'),
         },
         annotations: { readOnlyHint: false },
-    }, safeLicensed('generate_docs_site', async (args) => handleGenerateDocsSite(args)));
+    }, safeGoverned('generate_docs_site', async (args) => handleGenerateDocsSite(args)));
     // ── Memory config tools ────────────────────────────────────────────────────
     server.registerTool('configure_memory', {
         description: 'Configure persistent AI memory for your project using OpenMemory (local) or Mem0 Cloud. ' +
@@ -818,7 +735,7 @@ export function registerInfraGroupTools(server) {
                 .optional()
                 .describe('Mem0 API key — required for setup-mem0-cloud action. Get from https://app.mem0.ai'),
         },
-    }, safeLicensed('configure_memory', async (args) => handleConfigureMemory(args)));
+    }, safeGoverned('configure_memory', async (args) => handleConfigureMemory(args)));
     server.registerTool('memory_status', {
         description: 'Returns the current AI memory configuration status. ' +
             'Shows which provider is configured (none, openmemory, mem0-cloud) and the config file path.',
@@ -826,7 +743,7 @@ export function registerInfraGroupTools(server) {
         inputSchema: {
             projectPath: z.string().describe('Absolute path to the project root directory'),
         },
-    }, safeLicensed('memory_status', async (args) => handleMemoryStatus(args)));
+    }, safeGoverned('memory_status', async (args) => handleMemoryStatus(args)));
     // ── Code graph tools ──────────────────────────────────────────────────────
     server.registerTool('configure_code_graph', {
         description: 'Configure a local code graph MCP provider for the project. Supports Colby CodeGraph, CodeGraphContext, Pathfinder, and Axon. Writes the provider entry to .claude.json.',
@@ -843,14 +760,14 @@ export function registerInfraGroupTools(server) {
             ])
                 .describe('setup-colby-codegraph: configure @colbymchenry/codegraph | setup-codegraph-context: configure CodeGraphContext | setup-pathfinder: configure Pathfinder | setup-axon: configure Axon | status: show current provider status'),
         },
-    }, safeLicensed('configure_code_graph', async (args) => handleConfigureCodeGraph(args)));
+    }, safeGoverned('configure_code_graph', async (args) => handleConfigureCodeGraph(args)));
     server.registerTool('code_graph_status', {
         description: 'Returns the current code graph MCP provider status from .claude.json, including the active provider if one is configured.',
         annotations: { title: 'Code Graph Status', readOnlyHint: true },
         inputSchema: {
             projectPath: z.string().min(1).max(4096).describe('Absolute path to the project root'),
         },
-    }, safeLicensed('code_graph_status', async (args) => handleCodeGraphStatus(args)));
+    }, safeGoverned('code_graph_status', async (args) => handleCodeGraphStatus(args)));
     // ── Onboarding tools ───────────────────────────────────────────────────────
     server.registerTool('start_onboarding', {
         description: 'Start interactive onboarding for a new project. Generates personalized recommendations based on your role, project type, and team size. Returns a markdown guide with next steps.',
@@ -865,7 +782,7 @@ export function registerInfraGroupTools(server) {
             teamSize: z.enum(['1', '2-5', '6-20', '20+']).describe('Team size: 1, 2-5, 6-20, 20+'),
         },
         annotations: { readOnlyHint: false },
-    }, safeLicensed('start_onboarding', async (args) => handleStartOnboarding(args)));
+    }, safeGoverned('start_onboarding', async (args) => handleStartOnboarding(args)));
     server.registerTool('guided_tour', {
         description: 'Get a step-by-step guided tour of a Planu feature area. Returns markdown with numbered steps, examples, and tool hints.',
         inputSchema: {
@@ -881,14 +798,14 @@ export function registerInfraGroupTools(server) {
                 .describe('Tour area: spec-lifecycle, team-collaboration, integrations, ai-tools, security, reporting'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('guided_tour', async (args) => handleGuidedTour(args)));
+    }, safeGoverned('guided_tour', async (args) => handleGuidedTour(args)));
     server.registerTool('onboarding_checklist', {
         description: 'Check what onboarding steps are complete for a project. Verifies planu.json, CLAUDE.md, specs, rules, and skills. Returns a checklist with progress percentage.',
         inputSchema: {
             projectPath: z.string().min(1).max(4096).describe('Absolute path to the project root'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('onboarding_checklist', async (args) => handleOnboardingChecklist(args)));
+    }, safeGoverned('onboarding_checklist', async (args) => handleOnboardingChecklist(args)));
     server.registerTool('quick_start', {
         description: 'Get a quick start guide for a common project archetype. Returns a markdown guide with copy-paste commands.',
         inputSchema: {
@@ -903,14 +820,14 @@ export function registerInfraGroupTools(server) {
                 .describe('Optional project path to personalize the guide'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('quick_start', async (args) => handleQuickStart(args)));
+    }, safeGoverned('quick_start', async (args) => handleQuickStart(args)));
     server.registerTool('onboarding_progress', {
         description: 'View onboarding progress for a project. Shows setup checklist, profile, and next recommended steps.',
         inputSchema: {
             projectPath: z.string().min(1).max(4096).describe('Absolute path to the project root'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('onboarding_progress', async (args) => handleOnboardingProgress(args)));
+    }, safeGoverned('onboarding_progress', async (args) => handleOnboardingProgress(args)));
     // ── Docs registry tools ────────────────────────────────────────────────────
     server.registerTool('validate_docs_registry', {
         description: 'Check all entries in the built-in docs-registry.json for broken or slow links. ' +
@@ -923,7 +840,7 @@ export function registerInfraGroupTools(server) {
                 .describe('Absolute path to the project root (used for context only).'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('validate_docs_registry', async (args) => {
+    }, safeGoverned('validate_docs_registry', async (args) => {
         return handleValidateDocsRegistry(args);
     }));
     server.registerTool('discover_docs_url', {
@@ -938,7 +855,7 @@ export function registerInfraGroupTools(server) {
                 .describe('Package or library name to look up (e.g. "axios", "requests", "tokio").'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('discover_docs_url', async (args) => {
+    }, safeGoverned('discover_docs_url', async (args) => {
         return handleDiscoverDocsUrl(args);
     }));
     // ── GC tools ───────────────────────────────────────────────────────────────