@plune-ai/cli 0.33.0 → 0.34.1

package/dist/cli.cjs

@@ -1672,18 +1672,18 @@ var init_judge = __esm({
 });
 
 // src/orchestrator/concurrency.ts
-async function mapLimit(items, limit, fn) {
-  const results = new Array(items.length);
+async function mapLimit(items2, limit, fn) {
+  const results = new Array(items2.length);
   let next = 0;
   const worker = async () => {
-    while (next < items.length) {
+    while (next < items2.length) {
       const i = next;
       next += 1;
-      results[i] = await fn(items[i], i);
+      results[i] = await fn(items2[i], i);
     }
   };
   const safeLimit = Number.isFinite(limit) && limit >= 1 ? Math.floor(limit) : 1;
-  const workerCount = Math.min(safeLimit, items.length);
+  const workerCount = Math.min(safeLimit, items2.length);
   await Promise.all(Array.from({ length: workerCount }, () => worker()));
   return results;
 }
@@ -1991,7 +1991,7 @@ async function runOrchestration(config, options, deps) {
     throw new RunConfigError("--no-cache and --cache-max-age cannot be used together");
   }
   const started = deps.now();
-  const dryRun = options.dryRun ?? false;
+  const dryRun2 = options.dryRun ?? false;
   const evalResults = [];
   const prepared = selectEvals(config.evals, options.only).map((ev) => {
     const template = resolveTemplate(ev, deps.baseDir);
@@ -2010,14 +2010,15 @@ async function runOrchestration(config, options, deps) {
       limit,
       (row) => runRow({
         template,
-        assertions: ev.assertions,
+        // `defaults.assertions` apply to every eval, ahead of its own (#2415).
+        assertions: [...config.defaults?.assertions ?? [], ...ev.assertions],
         row,
         providerConfig,
         provider,
         embedder: deps.embedder,
         cache: deps.cache,
         now: deps.now,
-        dryRun,
+        dryRun: dryRun2,
         noCache,
         cacheStrict,
         ...options.cacheMaxAgeMs !== void 0 ? { cacheMaxAgeMs: options.cacheMaxAgeMs } : {}
@@ -2143,18 +2144,18 @@ __export(run_exports, {
 function isMockMode(env) {
   return env["PLUNE_MOCK_PROVIDER"] === "1";
 }
-function resolveProviderFor(config, dryRun) {
+function resolveProviderFor(config, dryRun2) {
   if (isMockMode(process.env)) return () => makeMockProvider();
-  if (dryRun) return (cfg) => makeEstimateProvider(cfg, config.pricing);
+  if (dryRun2) return (cfg) => makeEstimateProvider(cfg, config.pricing);
   return (cfg) => getProvider(cfg, process.env, config.pricing);
 }
-function buildRealDeps(config, baseDir, dryRun) {
+function buildRealDeps(config, baseDir, dryRun2) {
   const dir = path5.join(baseDir, ".plune");
   fs5.mkdirSync(dir, { recursive: true });
   return {
-    resolveProvider: resolveProviderFor(config, dryRun),
+    resolveProvider: resolveProviderFor(config, dryRun2),
     embedder: getDefaultEmbedder(),
-    cache: dryRun ? NOOP_CACHE : openCache(path5.join(dir, "cache.db")),
+    cache: dryRun2 ? NOOP_CACHE : openCache(path5.join(dir, "cache.db")),
     now: Date.now,
     loadDataset,
     baseDir
@@ -2225,8 +2226,8 @@ function wrap(code, s) {
 }
 function createStyler(color) {
   if (!color) {
-    const id = (s) => s;
-    return { green: id, red: id, yellow: id, dim: id, bold: id };
+    const id2 = (s) => s;
+    return { green: id2, red: id2, yellow: id2, dim: id2, bold: id2 };
   }
   return {
     green: (s) => wrap(CODE.green, s),
@@ -2596,7 +2597,7 @@ function createClient(opts) {
   }
   const base = opts.apiUrl.replace(/\/+$/, "");
   const scrub = (text2) => opts.token === "" ? text2 : text2.split(opts.token).join("***");
-  async function send(method, path21, payload, retries = DEFAULT_RETRIES) {
+  async function send(method, path22, payload, retries = DEFAULT_RETRIES) {
     let last = {
       kind: "unavailable",
       status: null,
@@ -2607,7 +2608,7 @@ function createClient(opts) {
       await respectPause(mine);
       let res;
       try {
-        res = await doFetch(`${base}${path21}`, {
+        res = await doFetch(`${base}${path22}`, {
           method,
           headers: { "content-type": payload?.type ?? "application/json", authorization: `Bearer ${opts.token}` },
           // A DELETE carries none. Sending `"undefined"` as a body is what a naive
@@ -2646,10 +2647,10 @@ function createClient(opts) {
     return { ok: false, ...last };
   }
   return {
-    post: (path21, body, retries) => send("POST", path21, { body: JSON.stringify(body), type: "application/json" }, retries),
-    upload: (path21, bytes, contentType) => send("POST", path21, { body: bytes, type: contentType }, uploadRetries ?? DEFAULT_RETRIES),
-    del: (path21) => send("DELETE", path21),
-    get: (path21) => send("GET", path21),
+    post: (path22, body, retries) => send("POST", path22, { body: JSON.stringify(body), type: "application/json" }, retries),
+    upload: (path22, bytes, contentType) => send("POST", path22, { body: bytes, type: contentType }, uploadRetries ?? DEFAULT_RETRIES),
+    del: (path22) => send("DELETE", path22),
+    get: (path22) => send("GET", path22),
     async put(url, headers, source) {
       const putRetries = uploadRetries ?? 3;
       let last = { ok: false, status: null, code: "network" };
@@ -2763,8 +2764,8 @@ function bounded(env, name, range, warnings) {
 function list(env, name) {
   const raw = value(env, name);
   if (raw === void 0) return void 0;
-  const items = raw.split(",").map((s) => s.trim()).filter((s) => s !== "");
-  return items.length === 0 ? void 0 : items;
+  const items2 = raw.split(",").map((s) => s.trim()).filter((s) => s !== "");
+  return items2.length === 0 ? void 0 : items2;
 }
 function readEnv(env = process.env) {
   const externalKey = value(env, "PLUNE_RUN");
@@ -2887,13 +2888,13 @@ var init_fallback = __esm({
 function failureOf(attempt, home = (0, import_node_os2.homedir)()) {
   const error = chosen(attempt);
   const line = error === void 0 ? void 0 : firstLine(machineless(error.text, attempt.repoRoot, home));
-  const headline = line !== void 0 && jsonBytes(line) <= HEADLINE_LIMIT ? line : void 0;
+  const headline2 = line !== void 0 && jsonBytes(line) <= HEADLINE_LIMIT ? line : void 0;
   const steps = chainOf(attempt.steps);
   const location = error === void 0 ? void 0 : fromRoot(placeOf(error, attempt.testFile), attempt.repoRoot);
   const artifacts = attempt.attachments.filter((a) => a.path !== void 0 && !a.name.startsWith("_") && a.contentType !== METADATA_TYPE).map(({ name, contentType }) => ({ name: fileNameOf(name), ...contentType ? { contentType } : {} })).filter((a) => a.name !== "");
   const ciUrl = webLink(attempt.buildHref);
   const failure = {
-    ...headline !== void 0 ? { headline } : {},
+    ...headline2 !== void 0 ? { headline: headline2 } : {},
     ...steps.length > 0 ? { steps } : {},
     ...location !== void 0 ? { location } : {},
     ...artifacts.length > 0 ? { artifacts } : {},
@@ -2930,12 +2931,12 @@ function machineless(raw, repoRoot, home) {
   if (repoRoot === void 0) text2 = text2.replace(ANY_HOME, "~");
   return text2;
 }
-function pathIn(path21) {
-  const parts = path21.split(/[\\/]+/);
+function pathIn(path22) {
+  const parts = path22.split(/[\\/]+/);
   while (parts.length > 1 && parts.at(-1) === "") parts.pop();
   if (!parts.some((part) => part !== "" && !/^[A-Za-z]:$/.test(part))) return void 0;
   const joined = parts.map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[\\\\/]+");
-  const escaped = /^\/(?!\/)/.test(path21) ? joined.replace("[\\\\/]+", "\\\\*\\/") : joined;
+  const escaped = /^\/(?!\/)/.test(path22) ? joined.replace("[\\\\/]+", "\\\\*\\/") : joined;
   const url = "(?:(?:file|webpack|webpack-internal):(?:\\\\*\\/){2,3})?";
   return new RegExp(`${url}${escaped}`, /^[A-Za-z]:$/.test(parts[0]) ? "gi" : "g");
 }
@@ -2981,12 +2982,12 @@ function placeOf(error, testFile) {
 }
 function fileOf(raw) {
   if (!raw.startsWith("file://")) return raw;
-  let path21 = raw.slice("file://".length);
+  let path22 = raw.slice("file://".length);
   try {
-    path21 = decodeURIComponent(path21);
+    path22 = decodeURIComponent(path22);
   } catch {
   }
-  return /^\/[A-Za-z]:\//.test(path21) ? path21.slice(1) : path21;
+  return /^\/[A-Za-z]:\//.test(path22) ? path22.slice(1) : path22;
 }
 function fromRoot(place, root) {
   if (place === void 0 || root === void 0 || !Number.isInteger(place.line) || place.line < 1) return void 0;
@@ -3026,14 +3027,14 @@ var init_failure_detail = __esm({
     FRAME = /^\s+at (?:.*? \()?(.+?):(\d+):(\d+)\)?$/;
     FRAME_MAX = 8192;
     firstLine = (text2) => (0, import_node_util.stripVTControlCharacters)(text2).split("\n").map((line) => line.trim()).find((line) => line !== "");
-    normal = (path21) => import_node_path2.posix.normalize(path21.replace(/\\/g, "/")).replace(/^([a-z]):/, (_, drive) => `${drive.toUpperCase()}:`);
+    normal = (path22) => import_node_path2.posix.normalize(path22.replace(/\\/g, "/")).replace(/^([a-z]):/, (_, drive) => `${drive.toUpperCase()}:`);
   }
 });
 
 // src/reporter-core/files-batch.ts
-async function sha256File(path21) {
+async function sha256File(path22) {
   const hash = (0, import_node_crypto2.createHash)("sha256");
-  for await (const part of (0, import_node_fs4.createReadStream)(path21)) hash.update(part);
+  for await (const part of (0, import_node_fs4.createReadStream)(path22)) hash.update(part);
   return hash.digest("hex");
 }
 var import_node_crypto2, import_node_fs4, FILES_BATCH_MAX, DIRECT_BATCH_BYTES, BATCH_PIPELINES, sha256Bytes, BUCKET_CODES;
@@ -3140,9 +3141,9 @@ function packed(results) {
   if (part.length > 0) out.push(part);
   return out;
 }
-function chunk(items, size) {
+function chunk(items2, size) {
   const out = [];
-  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
+  for (let i = 0; i < items2.length; i += size) out.push(items2.slice(i, i + size));
   return out;
 }
 function warnIfDropped(sent, run, log) {
@@ -3645,15 +3646,15 @@ async function startRun(passed, declared2) {
     await complete(toComplete);
     await sendDirect(directs);
   }
-  async function complete(items) {
-    for (let round = 0; items.length > 0; round += 1) {
+  async function complete(items2) {
+    for (let round = 0; items2.length > 0; round += 1) {
       const out = await gated(() => {
         requests += 1;
-        return client.post("/v1/files/complete-batch", { ids: items.map((i) => i.id) }, uploadRetries);
+        return client.post("/v1/files/complete-batch", { ids: items2.map((i) => i.id) }, uploadRetries);
       });
       if (routeMissing(out)) {
         await Promise.all(
-          items.map(
+          items2.map(
             (i) => gated(async () => {
               requests += 1;
               const one = await client.post(`/v1/files/${encodeURIComponent(i.id)}/complete`, {}, uploadRetries);
@@ -3665,28 +3666,28 @@ async function startRun(passed, declared2) {
         return;
       }
       const verdicts = out.ok ? out.body?.items : void 0;
-      if (!out.ok || !Array.isArray(verdicts) || verdicts.length !== items.length) {
-        for (const i of items) failedToBucket(i.job, out.ok ? "bad_answer" : codeOf2(out));
+      if (!out.ok || !Array.isArray(verdicts) || verdicts.length !== items2.length) {
+        for (const i of items2) failedToBucket(i.job, out.ok ? "bad_answer" : codeOf2(out));
         return;
       }
       const again = [];
-      items.forEach((i, at) => {
+      items2.forEach((i, at) => {
         const v = verdicts[at] ?? {};
         if (v.status === "ready") countsOf(i.job.kind).uploaded += 1;
         else if (v.retryable === true && round < Math.min(uploadRetries, 3)) again.push(i);
         else refusedItem(i.job, 0, v.status === "refused" ? v : { code: "bad_answer" });
       });
-      items = again;
-      if (items.length > 0) {
-        retried += items.length;
+      items2 = again;
+      if (items2.length > 0) {
+        retried += items2.length;
         await itemPause(round);
       }
     }
   }
-  async function sendDirect(items) {
+  async function sendDirect(items2) {
     const groups = [];
     let bytes = 0;
-    for (const item of items) {
+    for (const item of items2) {
       const group = groups[groups.length - 1];
       if (group === void 0 || group.length >= FILES_BATCH_MAX || bytes + item.size > DIRECT_BATCH_BYTES) {
         groups.push([item]);
@@ -3752,10 +3753,10 @@ async function startRun(passed, declared2) {
       })
     );
   }
-  async function upload(items, filesByKey) {
-    if (filesByKey.size === 0 || !Array.isArray(items)) return;
+  async function upload(items2, filesByKey) {
+    if (filesByKey.size === 0 || !Array.isArray(items2)) return;
     const jobs = [];
-    for (const item of items) {
+    for (const item of items2) {
       if (item?.status !== "accepted" || typeof item.id !== "string" || typeof item.resultKey !== "string") continue;
       for (const file of filesByKey.get(item.resultKey) ?? []) {
         const type = mediaTypeOf(file.contentType) ?? (file.path === void 0 ? void 0 : TYPE_BY_EXTENSION[(0, import_node_path3.extname)(file.path).toLowerCase()]);
@@ -4110,9 +4111,9 @@ function connect(deps) {
 `))
   };
 }
-function runUrl(apiUrl, id) {
+function runUrl(apiUrl, id2) {
   const web = dashboardUrl(apiUrl);
-  return web === void 0 ? `${apiUrl}/v1/runs/${id}` : `${web}/runs/${id}`;
+  return web === void 0 ? `${apiUrl}/v1/runs/${id2}` : `${web}/runs/${id2}`;
 }
 async function handleRunStart(options = {}) {
   const { client, apiUrl, write } = connect(options);
@@ -4140,39 +4141,39 @@ async function handleRunStart(options = {}) {
   }
   return result;
 }
-async function handleRunFinish(id, options = {}, runnerCode) {
+async function handleRunFinish(id2, options = {}, runnerCode) {
   const { client, write } = connect(options);
   const event = options.terminate === true ? "terminate" : "finish";
-  const out = await client.post(`/v1/runs/${id}/events`, {
+  const out = await client.post(`/v1/runs/${id2}/events`, {
     event,
     ...options.reason !== void 0 ? { reason: options.reason } : {}
   });
   if (!out.ok) {
     throw new RunCommandError(
-      out.status === 404 ? `No run '${id}' \u2014 check the id, or whether the token belongs to the same project.` : `Could not ${event} run ${id} \u2014 ${out.detail || out.kind}.`
+      out.status === 404 ? `No run '${id2}' \u2014 check the id, or whether the token belongs to the same project.` : `Could not ${event} run ${id2} \u2014 ${out.detail || out.kind}.`
     );
   }
-  write(`Run ${id} ${event === "finish" ? "finished" : "terminated"}.`);
+  write(`Run ${id2} ${event === "finish" ? "finished" : "terminated"}.`);
   if (options.failOnFailures !== true) return runnerCode ?? 0;
   const summary = out.body?.summary;
   const gate = gateExit({ statusEvent: out.body?.run?.statusEvent, counts: summary?.counts, notRun: summary?.notRun }, runnerCode);
   write(gate.line);
   return gate.code;
 }
-async function handleRunDelete(id, options = {}) {
+async function handleRunDelete(id2, options = {}) {
   const { client, write } = connect(options);
-  const out = await client.del(`/v1/runs/${encodeURIComponent(id)}`);
+  const out = await client.del(`/v1/runs/${encodeURIComponent(id2)}`);
   if (!out.ok) {
     throw new RunCommandError(
       out.status === 404 ? (
         // Three causes, one answer, and the message names all three because the platform will not:
         // a 404 that distinguished "not yours" from "not there" would tell a stranger which ids
         // exist. The person holding the terminal is better served by the list than by a guess.
-        `No run '${id}' \u2014 check the id, whether the token belongs to the same project, or whether it is already deleted.`
-      ) : `Could not delete run ${id} \u2014 ${out.detail || out.kind}.`
+        `No run '${id2}' \u2014 check the id, whether the token belongs to the same project, or whether it is already deleted.`
+      ) : `Could not delete run ${id2} \u2014 ${out.detail || out.kind}.`
     );
   }
-  write(`Run ${id} deleted, with its results and the review-queue entries it produced.`);
+  write(`Run ${id2} deleted, with its results and the review-queue entries it produced.`);
   write("Recoverable for 30 days \u2014 an owner of the project can put it back from Settings \u2192 Bin.");
 }
 async function handleRunExec(options) {
@@ -4456,11 +4457,11 @@ var init_job_reporter = __esm({
       }
       async finish(outcome) {
         if (this.id === void 0) return;
-        const id = this.id;
+        const id2 = this.id;
         this.id = void 0;
         await this.send(
           "PATCH",
-          `/${encodeURIComponent(id)}/state`,
+          `/${encodeURIComponent(id2)}/state`,
           outcome.ok ? { state: "completed" } : { state: "failed", reason: outcome.reason.slice(0, JOB_REASON_MAX) }
         );
       }
@@ -4552,11 +4553,11 @@ async function handleSync(deps = {}) {
       throw new SyncHttpError(res.status, detail);
     }
     const body = await res.json().catch(() => ({}));
-    const id = typeof body.id === "string" ? body.id : "";
-    const result = { id, url: `${endpoint}/${id}` };
-    await job.uploaded({ cursor: id || void 0 });
+    const id2 = typeof body.id === "string" ? body.id : "";
+    const result = { id: id2, url: `${endpoint}/${id2}` };
+    await job.uploaded({ cursor: id2 || void 0 });
     if (deps.failOnFailures === true) {
-      result.gate = gateExit(await readVerdict(doFetch, `${endpoint}/${id}/summary`, bearer));
+      result.gate = gateExit(await readVerdict(doFetch, `${endpoint}/${id2}/summary`, bearer));
     }
     return result;
   }
@@ -4666,10 +4667,10 @@ function platformGet(deps) {
   const token = (deps.loadToken ?? loadToken)();
   if (token === null) throw new NotLoggedInError();
   const doFetch = deps.fetchImpl ?? fetch;
-  return async (path21) => {
+  return async (path22) => {
     let res;
     try {
-      res = await doFetch(`${apiUrl}${path21}`, { headers: { authorization: `Bearer ${token}` } });
+      res = await doFetch(`${apiUrl}${path22}`, { headers: { authorization: `Bearer ${token}` } });
     } catch {
       throw new SyncNetworkError(apiUrl);
     }
@@ -5024,9 +5025,9 @@ var init_read_file = __esm({
 });
 
 // src/importers/allure.ts
-function isFolder(path21) {
+function isFolder(path22) {
   try {
-    return fs12.statSync(path21).isDirectory();
+    return fs12.statSync(path22).isDirectory();
   } catch {
     return false;
   }
@@ -5127,8 +5128,8 @@ function readAllure(dir, missing = [], notes = [], maxBytes = MAX_JSON_BYTES) {
   const ctx = { folder, lexical, missing, notes, around, direct };
   const groups = /* @__PURE__ */ new Map();
   tests.forEach((r, i) => {
-    const id = textOf(r.historyId);
-    const g = id === "" ? `\0${i}` : id;
+    const id2 = textOf(r.historyId);
+    const g = id2 === "" ? `\0${i}` : id2;
     const list2 = groups.get(g);
     if (list2 === void 0) groups.set(g, [r]);
     else list2.push(r);
@@ -5540,10 +5541,10 @@ function attemptOf(result, file, ctx) {
       ...typeof at?.file === "string" && typeof at.line === "number" ? { location: { file: at.file, line: at.line, ...typeof at.column === "number" ? { column: at.column } : {} } } : {}
     })),
     steps: steps(result.steps),
-    attachments: (result.attachments ?? []).map(({ name, contentType, path: path21, body }) => ({
+    attachments: (result.attachments ?? []).map(({ name, contentType, path: path22, body }) => ({
       name: name ?? "",
       ...contentType !== void 0 ? { contentType } : {},
-      ...path21 !== void 0 ? { path: path21 } : {},
+      ...path22 !== void 0 ? { path: path22 } : {},
       // Decoded only where the platform would take it (plune-ai/plune#928): a report of screenshots kept as
       // bodies is megabytes of base64 that nothing here will read.
       ...typeof body === "string" && isTextType(contentType) ? { body: Buffer.from(body, "base64") } : {}
@@ -5783,25 +5784,25 @@ function readLighthouse(source, file, minScores = {}) {
   const specRef = path14.basename(file);
   const known = Object.entries(categories).filter(([, raw]) => isObject2(raw)).map(([key, raw]) => idOf(key, raw));
   if (known.length > 0) {
-    for (const [id, score] of Object.entries(minScores)) {
-      if (!known.includes(id)) {
+    for (const [id2, score] of Object.entries(minScores)) {
+      if (!known.includes(id2)) {
         throw new JsonReportError(
           file,
-          `--min-score ${printable(id)}=${score} names a category the report does not have; it has ${known.map(printable).join(", ")}.`
+          `--min-score ${printable(id2)}=${score} names a category the report does not have; it has ${known.map(printable).join(", ")}.`
         );
       }
     }
   }
   const out = [];
-  const result = (id, passed, message) => {
-    const value2 = `${SOURCE5}#${url ?? ""}#${formFactor !== void 0 ? `${formFactor}#` : ""}${id}`;
+  const result = (id2, passed, message) => {
+    const value2 = `${SOURCE5}#${url ?? ""}#${formFactor !== void 0 ? `${formFactor}#` : ""}${id2}`;
     const where = [url, formFactor].filter((part) => part !== void 0);
     out.push({
       resultKey: resultKey(value2, 0),
       keys: [{ kind: "path-title", value: value2 }],
       source: SOURCE5,
       rawStatus: passed ? "passed" : "failed",
-      title: where.length > 0 ? `${id} (${where.join(", ")})` : id,
+      title: where.length > 0 ? `${id2} (${where.join(", ")})` : id2,
       specRef,
       ...execution !== void 0 ? { execution } : {},
       errorContext: message
@@ -5810,9 +5811,9 @@ function readLighthouse(source, file, minScores = {}) {
   for (const [key, raw] of Object.entries(categories)) {
     if (!isObject2(raw)) continue;
     const category = raw;
-    const id = idOf(key, category);
-    const name = typeof category.title === "string" && category.title !== "" ? category.title : id;
-    const bar = (Object.hasOwn(minScores, id) ? minScores[id] : void 0) ?? DEFAULT_MIN_SCORE;
+    const id2 = idOf(key, category);
+    const name = typeof category.title === "string" && category.title !== "" ? category.title : id2;
+    const bar = (Object.hasOwn(minScores, id2) ? minScores[id2] : void 0) ?? DEFAULT_MIN_SCORE;
     let passed = false;
     let message;
     if (runtimeError !== void 0) {
@@ -5824,7 +5825,7 @@ function readLighthouse(source, file, minScores = {}) {
       passed = shown >= bar;
       message = `Lighthouse ${name} score: ${shown}, ${passed ? "at least" : "below"} the ${bar} needed to pass.`;
     }
-    result(id, passed, message);
+    result(id2, passed, message);
   }
   if (out.length === 0 && runtimeError !== void 0) result("run", false, runtimeError);
   if (out.length === 0) {
@@ -6103,9 +6104,9 @@ async function handleRunImport(options) {
   for (const line of session.shardLines) write(line);
   return result;
 }
-function runUrl2(apiUrl, id) {
+function runUrl2(apiUrl, id2) {
   const web = dashboardUrl(apiUrl);
-  return web === void 0 ? `${apiUrl}/v1/runs/${id}` : `${web}/runs/${id}`;
+  return web === void 0 ? `${apiUrl}/v1/runs/${id2}` : `${web}/runs/${id2}`;
 }
 function describe(result, apiUrl) {
   const lines = [
@@ -6241,16 +6242,17 @@ function classify2(baseline, current) {
   if (baseline === "absent") return current === "passed" ? "new-pass" : "new-fail";
   if (current === "absent") return "removed";
   if (baseline === "passed") return current === "passed" ? "stable-pass" : "regression";
-  return current === "passed" ? "improvement" : "pre-existing-fail";
+  if (current === "passed") return "improvement";
+  return baseline === "errored" ? "unmeasured" : "pre-existing-fail";
 }
 function diffRuns(baseline, current) {
   const baseMap = new Map(baseline.evals.map((e) => [e.id, evalStatus(e)]));
   const curMap = new Map(current.evals.map((e) => [e.id, evalStatus(e)]));
   const ids = [.../* @__PURE__ */ new Set([...baseMap.keys(), ...curMap.keys()])];
-  const evals = ids.map((id) => {
-    const baselineP = baseMap.get(id) ?? "absent";
-    const currentP = curMap.get(id) ?? "absent";
-    return { id, status: classify2(baselineP, currentP), baseline: baselineP, current: currentP };
+  const evals = ids.map((id2) => {
+    const baselineP = baseMap.get(id2) ?? "absent";
+    const currentP = curMap.get(id2) ?? "absent";
+    return { id: id2, status: classify2(baselineP, currentP), baseline: baselineP, current: currentP };
   });
   const count2 = (s) => evals.filter((e) => e.status === s).length;
   const summary = {
@@ -6262,6 +6264,7 @@ function diffRuns(baseline, current) {
     stablePasses: count2("stable-pass"),
     errored: count2("errored"),
     removed: count2("removed"),
+    unmeasured: count2("errored") + count2("unmeasured"),
     hasRegression: count2("regression") > 0
   };
   return { evals, summary };
@@ -6332,6 +6335,11 @@ __export(diff_exports2, {
   renderDiff: () => renderDiff,
   renderDiffMarkdown: () => renderDiffMarkdown
 });
+function headline(d) {
+  if (d.summary.hasRegression) return { mark: "\u274C", text: `${d.summary.regressions} regression(s)` };
+  if (d.summary.unmeasured > 0) return { mark: "\u26A0\uFE0F", text: `${d.summary.unmeasured} eval(s) not measured` };
+  return null;
+}
 function summaryLine(d) {
   const s = d.summary;
   return [
@@ -6341,14 +6349,14 @@ function summaryLine(d) {
     `${s.preExistingFails} pre-existing-fail`,
     `${s.errored} errored`,
     `${s.removed} removed`,
+    `${s.unmeasured} not measured`,
     `${s.stablePasses} stable`
   ].join(" \xB7 ");
 }
 function renderDiffMarkdown(d) {
   const out = [STICKY_MARKER, "## Plune eval diff", ""];
-  out.push(
-    d.summary.hasRegression ? `### \u274C ${d.summary.regressions} regression(s)` : "### \u2705 No regressions"
-  );
+  const head = headline(d);
+  out.push(head ? `### ${head.mark} ${head.text}` : "### \u2705 No regressions");
   out.push("");
   const notable = d.evals.filter((e) => e.status !== "stable-pass");
   if (notable.length > 0) {
@@ -6363,9 +6371,8 @@ function renderDiffMarkdown(d) {
   return out.join("\n");
 }
 function renderDiffConsole(d) {
-  const out = [
-    d.summary.hasRegression ? `Plune eval diff: ${d.summary.regressions} regression(s)` : "Plune eval diff: no regressions"
-  ];
+  const head = headline(d);
+  const out = [`Plune eval diff: ${head ? head.text : "no regressions"}`];
   for (const e of d.evals) {
     if (e.status === "stable-pass") continue;
     out.push(`  ${e.id}: ${e.baseline} -> ${e.current} [${e.status}]`);
@@ -6395,6 +6402,7 @@ var init_diff3 = __esm({
       "new-pass": "\u{1F7E2} new pass",
       "stable-pass": "\u2705 stable",
       errored: "\u26A0\uFE0F errored",
+      unmeasured: "\u26A0\uFE0F not measured (baseline errored)",
       removed: "\u2796 removed"
     };
   }
@@ -6689,6 +6697,1033 @@ var init_logout = __esm({
   }
 });
 
+// src/mcp-tools/schemas.ts
+var import_zod4, BATCH_MAX2, isHttp, httpLink, id, dryRun, MISSION_STATES, MISSION_DOCUMENTATION, MISSION_LINK_KINDS, missionName, missionSummary, missionUrl, missionFields, sourceTitle, sourceVersion, linkSource, fileSource, ACCESS_KINDS, questionText, questionInput, STRATEGY_SOURCE_KINDS, TEST_LEVELS, QUALITY_CHARACTERISTICS, TEST_TECHNIQUES, RISK_SCALE, itemFields, strategyItem, items, unique, linkIds, share, strategyContent, SOURCE_REF_KINDS, proposedCase, API_METHODS, proposedEndpoint, REVIEW_STATES, REVIEW_KINDS, REJECTION_CATEGORIES, entity, plannedRequest, writeOutput, batchOutput, bulkPreview;
+var init_schemas = __esm({
+  "src/mcp-tools/schemas.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_zod4 = require("zod");
+    BATCH_MAX2 = 100;
+    isHttp = (s) => {
+      try {
+        const u = new URL(s);
+        return u.protocol === "http:" || u.protocol === "https:";
+      } catch {
+        return false;
+      }
+    };
+    httpLink = (what, max) => import_zod4.z.string().trim().min(1, `${what} is empty`).max(max).refine(isHttp, `${what} must be an http or https address`);
+    id = (what) => import_zod4.z.string().min(1).describe(what);
+    dryRun = import_zod4.z.boolean().optional().describe("true: answer what would be sent, and send nothing");
+    MISSION_STATES = ["draft", "active", "done"];
+    MISSION_DOCUMENTATION = ["unknown", "provided", "none"];
+    MISSION_LINK_KINDS = ["url", "openapi", "repo", "ticket"];
+    missionName = import_zod4.z.string().trim().min(1, "a mission needs a name").max(200);
+    missionSummary = import_zod4.z.string().trim().max(2e3).describe("What the product is, in 3-5 sentences");
+    missionUrl = httpLink("url", 2048).nullable().describe("Where the product runs; null takes it off");
+    missionFields = {
+      name: missionName,
+      summary: missionSummary.optional(),
+      url: missionUrl.optional(),
+      state: import_zod4.z.enum(MISSION_STATES).optional(),
+      documentation: import_zod4.z.enum(MISSION_DOCUMENTATION).optional().describe("Is there documentation: provided (it is among the sources), none, or unknown")
+    };
+    sourceTitle = import_zod4.z.string().trim().min(1).max(200);
+    sourceVersion = import_zod4.z.string().trim().min(1).max(200).describe("A commit, a tag, a revision, an ETag");
+    linkSource = import_zod4.z.strictObject({
+      missionId: id("The mission"),
+      kind: import_zod4.z.enum(MISSION_LINK_KINDS),
+      ref: httpLink("ref", 2048).describe("The link"),
+      title: sourceTitle.optional(),
+      version: sourceVersion.optional(),
+      dry_run: dryRun
+    });
+    fileSource = import_zod4.z.strictObject({
+      missionId: id("The mission"),
+      kind: import_zod4.z.literal("file"),
+      name: import_zod4.z.string().trim().min(1).max(200).regex(/\.(txt|md|markdown|json)$/i, "a source file is .txt, .md, .markdown or .json").describe("The file name; its extension sets the type"),
+      text: import_zod4.z.string().max(1048576).describe("The whole text of the file, UTF-8, at most 1 MiB"),
+      title: sourceTitle.optional(),
+      version: sourceVersion.optional(),
+      dry_run: dryRun
+    });
+    ACCESS_KINDS = ["openapi", "repo", "staging", "har"];
+    questionText = import_zod4.z.string().trim().min(1).max(2e3);
+    questionInput = import_zod4.z.strictObject({
+      template: import_zod4.z.enum(["plain", "access"]).describe("plain: a question with up to three options; access: ask for an API description, the code, a staging host or a HAR file"),
+      text: questionText,
+      missionId: import_zod4.z.string().min(1).optional(),
+      options: import_zod4.z.array(import_zod4.z.string().trim().min(1).max(200)).min(1).max(3).refine((o) => new Set(o).size === o.length, { message: "no two options are the same" }).optional().describe("plain only: what the person may pick from"),
+      access: import_zod4.z.array(import_zod4.z.enum(ACCESS_KINDS)).min(1).max(ACCESS_KINDS.length).refine((a) => new Set(a).size === a.length, { message: "an access kind is named once" }).optional().describe("access only: what you ask to be given"),
+      dry_run: dryRun
+    });
+    STRATEGY_SOURCE_KINDS = ["mission-source", "doc-section", "screen", "endpoint", "requirement", "url"];
+    TEST_LEVELS = ["component", "component-integration", "system", "system-integration", "acceptance"];
+    QUALITY_CHARACTERISTICS = [
+      "functional-suitability",
+      "performance-efficiency",
+      "compatibility",
+      "interaction-capability",
+      "reliability",
+      "security",
+      "maintainability",
+      "flexibility",
+      "safety"
+    ];
+    TEST_TECHNIQUES = [
+      "equivalence-partitioning",
+      "boundary-value",
+      "decision-table",
+      "state-transition",
+      "statement",
+      "branch",
+      "error-guessing",
+      "exploratory",
+      "checklist"
+    ];
+    RISK_SCALE = ["low", "medium", "high"];
+    itemFields = {
+      text: import_zod4.z.string().trim().min(1).max(1e3).describe("Markdown"),
+      source: import_zod4.z.strictObject({ kind: import_zod4.z.enum(STRATEGY_SOURCE_KINDS), ref: import_zod4.z.string().trim().min(1).max(300) }).optional().describe("Where it was read"),
+      assumption: import_zod4.z.literal(true).optional().describe("You assumed it: a person confirms"),
+      waitingOn: import_zod4.z.string().min(1).optional().describe("The id of an open question of this mission it waits for")
+    };
+    strategyItem = import_zod4.z.strictObject(itemFields);
+    items = import_zod4.z.array(strategyItem).min(1).max(25);
+    unique = (values) => import_zod4.z.array(import_zod4.z.enum(values)).min(1).refine((a) => new Set(a).size === a.length, { message: "named once" });
+    linkIds = import_zod4.z.array(import_zod4.z.string().min(1)).max(50).refine((a) => new Set(a).size === a.length, { message: "an id is named once" });
+    share = import_zod4.z.number().int().min(0).max(100);
+    strategyContent = import_zod4.z.strictObject({
+      objectives: items,
+      scope: import_zod4.z.strictObject({ in: items, out: items.describe("What is deliberately not tested, and why") }),
+      approach: items,
+      profile: import_zod4.z.strictObject({
+        levels: unique(TEST_LEVELS),
+        characteristics: unique(QUALITY_CHARACTERISTICS),
+        techniques: unique(TEST_TECHNIQUES),
+        split: import_zod4.z.strictObject({ api: share, ui: share, manual: share }).refine((s) => s.api + s.ui + s.manual === 100, { message: "the split of api, ui and manual adds up to 100" }),
+        notes: items
+      }),
+      risks: import_zod4.z.array(
+        import_zod4.z.strictObject({
+          ...itemFields,
+          likelihood: import_zod4.z.enum(RISK_SCALE),
+          impact: import_zod4.z.enum(RISK_SCALE),
+          caseIds: linkIds.optional(),
+          requirementIds: linkIds.optional()
+        })
+      ).min(1).max(50),
+      entryCriteria: items,
+      exitCriteria: items
+    });
+    SOURCE_REF_KINDS = ["url", "openapi-operation", "requirement", "pasted-text"];
+    proposedCase = import_zod4.z.strictObject({
+      title: import_zod4.z.string().trim().min(1).max(300),
+      steps: import_zod4.z.array(import_zod4.z.string().trim().min(1).max(400)).min(1).max(20),
+      expected: import_zod4.z.string().trim().min(1).max(2e3),
+      execution: import_zod4.z.enum(["auto", "manual"]).optional().describe("auto: can be automated; manual (default): stays with a person"),
+      technique: import_zod4.z.string().min(1).max(32).optional(),
+      priority: import_zod4.z.string().min(1).optional(),
+      source: import_zod4.z.strictObject({ kind: import_zod4.z.enum(SOURCE_REF_KINDS), value: import_zod4.z.string().min(1).max(100) }).optional().describe("What you read to design it"),
+      rationale: import_zod4.z.string().min(1).max(400).optional().describe("Why the case is worth having")
+    });
+    API_METHODS = ["GET", "PUT", "POST", "DELETE", "OPTIONS", "HEAD", "PATCH", "TRACE"];
+    proposedEndpoint = import_zod4.z.strictObject({
+      method: import_zod4.z.enum(API_METHODS),
+      path: import_zod4.z.string().min(1).max(512).regex(/^\/[^?#\s]*$/, "a path template starts with / and has no query").describe("A template: /users/{id}, never /users/42"),
+      source: import_zod4.z.enum(["spec", "code", "traffic"]),
+      trust: import_zod4.z.enum(["confirmed", "derived"]).optional(),
+      summary: import_zod4.z.string().trim().min(1).max(500).optional(),
+      auth: import_zod4.z.array(import_zod4.z.string().trim().min(1).max(100)).max(10).optional(),
+      environment: import_zod4.z.string().trim().min(1).max(100).optional(),
+      seenAt: import_zod4.z.string().optional().describe("ISO 8601 date and time with an offset")
+    });
+    REVIEW_STATES = ["pending", "changes_requested", "approved", "rejected"];
+    REVIEW_KINDS = ["result", "proposal", "discovered", "endpoint", "strategy", "report", "memory_rule"];
+    REJECTION_CATEGORIES = ["duplicate", "incorrect", "out-of-scope", "low-value", "not-testable", "other"];
+    entity = import_zod4.z.looseObject({ id: import_zod4.z.string().optional() });
+    plannedRequest = import_zod4.z.object({
+      method: import_zod4.z.string(),
+      path: import_zod4.z.string(),
+      query: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.string()).optional(),
+      body: import_zod4.z.unknown().optional()
+    });
+    writeOutput = import_zod4.z.object({
+      dryRun: import_zod4.z.boolean(),
+      request: plannedRequest.optional(),
+      result: entity.optional()
+    });
+    batchOutput = import_zod4.z.object({
+      dryRun: import_zod4.z.boolean(),
+      requested: import_zod4.z.number().int(),
+      applied: import_zod4.z.number().int(),
+      requests: import_zod4.z.array(plannedRequest).optional(),
+      results: import_zod4.z.array(
+        import_zod4.z.object({
+          ok: import_zod4.z.boolean(),
+          status: import_zod4.z.number().int().optional(),
+          id: import_zod4.z.string().optional(),
+          error: import_zod4.z.string().optional(),
+          code: import_zod4.z.string().optional()
+        })
+      ).optional(),
+      report: import_zod4.z.looseObject({}).optional()
+    });
+    bulkPreview = import_zod4.z.looseObject({
+      total: import_zod4.z.number().int(),
+      confirm: import_zod4.z.string(),
+      expiresInSeconds: import_zod4.z.number().int()
+    });
+  }
+});
+
+// src/mcp-tools/contract.ts
+function pluneTool(name) {
+  const tool = BY_NAME.get(name);
+  if (tool === void 0) throw new Error(`unknown tool: ${name}`);
+  return tool;
+}
+function isPluneToolName(name) {
+  return BY_NAME.has(name);
+}
+function defaultVisibleTools(scope) {
+  return PLUNE_TOOLS.filter((t) => t.visibility === "core" && !(scope === "read" && t.write)).map((t) => t.name);
+}
+var import_zod5, MAX_VISIBLE_TOOLS, define, listPage, missionId, PLUNE_TOOLS, PLUNE_TOOL_NAMES, BY_NAME;
+var init_contract = __esm({
+  "src/mcp-tools/contract.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_zod5 = require("zod");
+    init_schemas();
+    MAX_VISIBLE_TOOLS = 20;
+    define = (tool) => tool;
+    listPage = {
+      limit: import_zod5.z.number().int().min(1).max(BATCH_MAX2).optional(),
+      cursor: import_zod5.z.string().min(1).optional().describe("nextCursor of the previous page")
+    };
+    missionId = id("The mission id");
+    PLUNE_TOOLS = [
+      define({
+        name: "plune_project_context",
+        title: "Project context",
+        description: "Start here: learn the project you are working in with one call \u2014 its projects, the suite tree, how many test cases it has, its testing missions, and how much waits in the review queue.",
+        input: import_zod5.z.strictObject({}),
+        output: import_zod5.z.object({
+          projectId: import_zod5.z.string().nullable(),
+          projects: import_zod5.z.array(entity),
+          suites: import_zod5.z.array(entity),
+          cases: import_zod5.z.object({ total: import_zod5.z.number().int() }),
+          missions: import_zod5.z.array(entity),
+          reviewQueue: import_zod5.z.object({ pending: import_zod5.z.number().int(), more: import_zod5.z.boolean() })
+        }),
+        write: false,
+        visibility: "core",
+        endpoints: ["GET /v1/projects", "GET /v1/suites", "GET /v1/test-cases", "GET /v1/missions", "GET /v1/review-items"]
+      }),
+      define({
+        name: "plune_get",
+        title: "Read one object",
+        description: "Read one test case, run or review queue entry in full when you already hold its id \u2014 steps, state, history fields and everything the platform keeps on it.",
+        input: import_zod5.z.strictObject({ kind: import_zod5.z.enum(["test-case", "run", "review-item"]), id: id("Its id") }),
+        output: import_zod5.z.object({ kind: import_zod5.z.string(), item: entity }),
+        write: false,
+        visibility: "core",
+        endpoints: ["GET /v1/test-cases/:id", "GET /v1/runs/:id", "GET /v1/review-items/:id"]
+      }),
+      define({
+        name: "plune_cases_search",
+        title: "Find test cases",
+        description: "Find test cases of the project by filter \u2014 suite, state, tag, priority, text and the other filters of the case list \u2014 one page at a time, with the total and how many match.",
+        input: import_zod5.z.strictObject({
+          filters: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.union([import_zod5.z.string(), import_zod5.z.array(import_zod5.z.string())])).optional().describe('Query filters of GET /v1/test-cases: a list is OR inside one key, keys are AND-ed (e.g. {"suiteId": "s1", "tag": ["smoke"]})'),
+          ...listPage
+        }),
+        output: import_zod5.z.object({
+          testCases: import_zod5.z.array(entity),
+          total: import_zod5.z.number().int().optional(),
+          matching: import_zod5.z.number().int().optional(),
+          nextCursor: import_zod5.z.string().nullable()
+        }),
+        write: false,
+        visibility: "core",
+        endpoints: ["GET /v1/test-cases?filters"]
+      }),
+      define({
+        name: "plune_review_list",
+        title: "Read the review queue",
+        description: "See what waits for a decision in the review queue \u2014 proposed cases, discovered tests, endpoints, strategies, reports \u2014 narrowed by state and kind, newest first, one page at a time.",
+        input: import_zod5.z.strictObject({
+          state: import_zod5.z.enum(REVIEW_STATES).optional(),
+          kinds: import_zod5.z.array(import_zod5.z.enum(REVIEW_KINDS)).min(1).optional().describe("Questions are read with the question tool"),
+          ...listPage
+        }),
+        output: import_zod5.z.object({ items: import_zod5.z.array(entity), nextCursor: import_zod5.z.string().nullable() }),
+        write: false,
+        visibility: "core",
+        endpoints: ["GET /v1/review-items"]
+      }),
+      define({
+        name: "plune_review_decide",
+        title: "Decide queue entries",
+        description: "Approve or reject up to 100 review queue entries in one decision. The first call changes nothing and returns a preview with a confirm value; repeat the same call with confirm to apply it.",
+        input: import_zod5.z.strictObject({
+          itemIds: import_zod5.z.array(import_zod5.z.string().min(1)).min(1).max(BATCH_MAX2).refine((a) => new Set(a).size === a.length, { message: "an id is named once" }),
+          verdict: import_zod5.z.enum(["approved", "rejected"]),
+          rejectionCategory: import_zod5.z.enum(REJECTION_CATEGORIES).optional().describe("Required to reject"),
+          note: import_zod5.z.string().trim().min(1).max(2e3).optional().describe("Why \u2014 required to reject"),
+          confirm: import_zod5.z.string().min(1).optional().describe("The confirm value of the preview")
+        }),
+        output: import_zod5.z.object({
+          requested: import_zod5.z.number().int(),
+          applied: import_zod5.z.number().int(),
+          preview: bulkPreview.optional(),
+          report: import_zod5.z.looseObject({}).optional()
+        }),
+        write: true,
+        visibility: "core",
+        endpoints: ["POST /v1/review-items/decisions"]
+      }),
+      define({
+        name: "plune_case_propose",
+        title: "Propose test cases",
+        description: "Propose up to 100 new test cases for a person to review: they land in the review queue as proposals and become cases only when someone approves them. Nothing is created silently.",
+        input: import_zod5.z.strictObject({
+          target: import_zod5.z.string().trim().min(1).max(2048).describe("What the cases test: the product address, or the mission name"),
+          cases: import_zod5.z.array(proposedCase).min(1).max(BATCH_MAX2),
+          dry_run: dryRun
+        }),
+        output: batchOutput,
+        write: true,
+        visibility: "core",
+        endpoints: ["POST /v1/ingest/cairn"]
+      }),
+      define({
+        name: "plune_mission_create",
+        title: "Create a mission",
+        description: "Create a testing mission for a product: its name, a short description of what the product is, where it runs, and whether documentation exists. It starts as a draft you fill in.",
+        input: import_zod5.z.strictObject({ ...missionFields, dry_run: dryRun }),
+        output: writeOutput,
+        write: true,
+        visibility: "core",
+        endpoints: ["POST /v1/missions"]
+      }),
+      define({
+        name: "plune_mission_get",
+        title: "Read a mission",
+        description: "Read a testing mission with everything it holds \u2014 its brief, state, documentation answer and every source attached to it \u2014 before planning or continuing the work on it.",
+        input: import_zod5.z.strictObject({ missionId }),
+        output: import_zod5.z.object({ mission: entity }),
+        write: false,
+        visibility: "core",
+        endpoints: ["GET /v1/missions/:id"]
+      }),
+      define({
+        name: "plune_mission_update",
+        title: "Update a mission",
+        description: "Change a testing mission: rename it, rewrite the brief, set or remove the address, answer whether documentation exists, or move it between draft, active and done.",
+        input: import_zod5.z.strictObject({
+          missionId,
+          name: missionFields.name.optional(),
+          summary: missionFields.summary,
+          url: missionFields.url,
+          state: missionFields.state,
+          documentation: missionFields.documentation,
+          dry_run: dryRun
+        }).refine((b) => ["name", "summary", "url", "state", "documentation"].some((k) => b[k] !== void 0), {
+          message: "nothing to change"
+        }),
+        output: writeOutput,
+        write: true,
+        visibility: "core",
+        endpoints: ["PATCH /v1/missions/:id"]
+      }),
+      define({
+        name: "plune_source_add",
+        title: "Add a source to a mission",
+        description: "Attach something to read to a mission: a link (page, OpenAPI document, repository, ticket) or the text of a file of the project \u2014 Markdown, plain text or JSON, up to 1 MiB.",
+        input: import_zod5.z.strictObject({
+          missionId,
+          kind: import_zod5.z.enum([...MISSION_LINK_KINDS, "file"]),
+          ref: import_zod5.z.string().optional().describe("The link, for url, openapi, repo and ticket"),
+          name: import_zod5.z.string().optional().describe("The file name, for file (.md, .markdown, .txt, .json)"),
+          text: import_zod5.z.string().optional().describe("The file text, for file"),
+          title: import_zod5.z.string().optional(),
+          version: import_zod5.z.string().optional(),
+          dry_run: dryRun
+        }).superRefine((b, ctx) => {
+          if (b.kind === "file" && (b.name === void 0 || b.text === void 0))
+            ctx.addIssue({ code: "custom", message: "a file source carries name and text" });
+          if (b.kind !== "file" && b.ref === void 0) ctx.addIssue({ code: "custom", message: "a link source carries ref" });
+        }),
+        output: writeOutput,
+        write: true,
+        visibility: "core",
+        endpoints: ["POST /v1/missions/:id/sources", "POST /v1/missions/:id/files"]
+      }),
+      define({
+        name: "plune_question_ask",
+        title: "Ask a person",
+        description: "Ask a person what you do not know instead of guessing: a plain question with up to three options, or a request for access to an API description, the code, staging or a HAR file.",
+        input: questionInput.superRefine((b, ctx) => {
+          if (b.template === "plain" && b.access !== void 0) ctx.addIssue({ code: "custom", message: "access belongs to an access question" });
+          if (b.template === "access" && b.options !== void 0) ctx.addIssue({ code: "custom", message: "options belong to a plain question" });
+          if (b.template === "access" && b.access === void 0) ctx.addIssue({ code: "custom", message: "an access question names the access" });
+        }),
+        output: writeOutput,
+        write: true,
+        visibility: "core",
+        endpoints: ["POST /v1/review-items/questions"]
+      }),
+      define({
+        name: "plune_question_list",
+        title: "Read questions and answers",
+        description: "Check the questions asked to people and the answers they gave \u2014 all of them or one mission's, waiting or answered \u2014 so the work continues from what a person actually said.",
+        input: import_zod5.z.strictObject({ missionId: import_zod5.z.string().min(1).optional(), state: import_zod5.z.enum(REVIEW_STATES).optional(), ...listPage }),
+        output: import_zod5.z.object({ questions: import_zod5.z.array(entity), nextCursor: import_zod5.z.string().nullable() }),
+        write: false,
+        visibility: "core",
+        endpoints: ["GET /v1/review-items?kind=question"]
+      }),
+      define({
+        name: "plune_strategy_propose",
+        title: "Propose a test strategy",
+        description: "Propose a test strategy for a mission in ISTQB sections \u2014 objectives, scope in and out, approach, levels and techniques, risks, entry and exit criteria \u2014 for a person to accept.",
+        input: import_zod5.z.strictObject({ missionId, content: strategyContent, dry_run: dryRun }),
+        output: writeOutput,
+        write: true,
+        visibility: "core",
+        endpoints: ["POST /v1/missions/:id/strategy"]
+      }),
+      define({
+        name: "plune_report_request",
+        title: "Request the mission report",
+        description: "Ask the platform to build the completion report of a mission from its own data and queue it for a person to approve; it needs an accepted strategy first.",
+        input: import_zod5.z.strictObject({ missionId, dry_run: dryRun }),
+        output: writeOutput,
+        write: true,
+        visibility: "core",
+        endpoints: ["POST /v1/missions/:id/report"]
+      }),
+      define({
+        name: "plune_discover_tools",
+        title: "Find more tools",
+        description: "Look for a capability that is not in your tool list \u2014 editing cases, writing results, starting runs, cataloguing API endpoints, a raw API call \u2014 and switch the ones you need on for this session.",
+        input: import_zod5.z.strictObject({
+          query: import_zod5.z.string().trim().min(1).max(200).optional().describe('Words of the task, e.g. "write results"'),
+          names: import_zod5.z.array(import_zod5.z.string().min(1)).min(1).max(MAX_VISIBLE_TOOLS).optional().describe("Tools to switch on")
+        }),
+        output: import_zod5.z.object({
+          revealed: import_zod5.z.array(import_zod5.z.string()),
+          available: import_zod5.z.array(import_zod5.z.object({ name: import_zod5.z.string(), title: import_zod5.z.string(), description: import_zod5.z.string(), write: import_zod5.z.boolean() })),
+          visible: import_zod5.z.array(import_zod5.z.string())
+        }),
+        write: false,
+        visibility: "core",
+        endpoints: ["LOCAL /discover"]
+      }),
+      define({
+        name: "plune_cases_update",
+        title: "Edit test cases",
+        description: "Edit up to 100 existing test cases in one call \u2014 title, steps, expected result, priority, tags, suite \u2014 each applied on its own, with a count of how many were applied.",
+        input: import_zod5.z.strictObject({
+          cases: import_zod5.z.array(import_zod5.z.strictObject({ id: id("The case id"), changes: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()).describe("Fields of PATCH /v1/test-cases/:id") })).min(1).max(BATCH_MAX2),
+          dry_run: dryRun
+        }),
+        output: batchOutput,
+        write: true,
+        visibility: "discoverable",
+        endpoints: ["PATCH /v1/test-cases/:id"]
+      }),
+      define({
+        name: "plune_run_create",
+        title: "Start a run",
+        description: "Start a test run on the platform to record results into \u2014 named, with its environment and the cases it covers \u2014 using the body of POST /v1/runs (schemaVersion 2).",
+        input: import_zod5.z.strictObject({ run: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()).describe("The body of POST /v1/runs"), dry_run: dryRun }),
+        output: writeOutput,
+        write: true,
+        visibility: "discoverable",
+        endpoints: ["POST /v1/runs"]
+      }),
+      define({
+        name: "plune_results_write",
+        title: "Write results into a run",
+        description: "Record up to 100 test results into an open run in one request \u2014 passed, failed, skipped, with their keys and evidence \u2014 and learn how many the platform accepted.",
+        input: import_zod5.z.strictObject({
+          runId: id("The run id"),
+          results: import_zod5.z.array(import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown())).min(1).max(BATCH_MAX2).describe("Results as POST /v1/runs/:id/results takes them"),
+          combination: import_zod5.z.number().int().min(0).optional(),
+          configuration: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.string()).optional(),
+          dry_run: dryRun
+        }),
+        output: batchOutput,
+        write: true,
+        visibility: "discoverable",
+        endpoints: ["POST /v1/runs/:id/results"]
+      }),
+      define({
+        name: "plune_endpoint_propose",
+        title: "Propose API endpoints",
+        description: "Propose up to 100 API endpoints you found in a spec, the code or traffic for the project's API catalog; each waits in the review queue until a person approves it.",
+        input: import_zod5.z.strictObject({ endpoints: import_zod5.z.array(proposedEndpoint).min(1).max(BATCH_MAX2), dry_run: dryRun }),
+        output: batchOutput,
+        write: true,
+        visibility: "discoverable",
+        endpoints: ["POST /v1/review-items/endpoints"]
+      }),
+      define({
+        name: "plune_api_request",
+        title: "Call the REST API directly",
+        description: "Reach any Plune REST endpoint under /v1 that no other tool covers. Every guard still holds: a deletion is previewed first and needs confirm, and the platform refuses an agent what it refuses over HTTP.",
+        input: import_zod5.z.strictObject({
+          method: import_zod5.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
+          path: import_zod5.z.string().min(1).max(2048).describe("A path under /v1, e.g. /v1/suites"),
+          query: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.string()).optional(),
+          body: import_zod5.z.unknown().optional(),
+          confirm: import_zod5.z.string().min(1).optional().describe("The confirm value of a preview"),
+          dry_run: dryRun
+        }),
+        output: import_zod5.z.object({
+          status: import_zod5.z.number().int().optional(),
+          body: import_zod5.z.unknown().optional(),
+          dryRun: import_zod5.z.boolean().optional(),
+          request: plannedRequest.optional(),
+          preview: import_zod5.z.looseObject({ method: import_zod5.z.string(), path: import_zod5.z.string(), confirm: import_zod5.z.string(), expiresInSeconds: import_zod5.z.number().int() }).optional()
+        }),
+        write: true,
+        visibility: "discoverable",
+        endpoints: ["ANY /v1/*"]
+      })
+    ];
+    PLUNE_TOOL_NAMES = PLUNE_TOOLS.map((t) => t.name);
+    BY_NAME = new Map(PLUNE_TOOLS.map((t) => [t.name, t]));
+  }
+});
+
+// src/mcp-tools/client.ts
+function bodyField(body, key) {
+  if (body === null || typeof body !== "object") return void 0;
+  const value2 = body[key];
+  return typeof value2 === "string" ? value2 : void 0;
+}
+function apiBase(apiUrl) {
+  return apiUrl.replace(/\/+$/, "");
+}
+function buildUrl(apiUrl, req) {
+  const url = new URL(apiBase(apiUrl) + req.path);
+  for (const [key, value2] of Object.entries(req.query ?? {})) {
+    for (const v of typeof value2 === "string" ? [value2] : value2) url.searchParams.append(key, v);
+  }
+  return url;
+}
+function createPluneApi(opts) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const headers = {
+    authorization: `Bearer ${opts.token}`,
+    accept: "application/json",
+    "x-plune-session": opts.sessionId,
+    ...opts.projectId === void 0 ? {} : { "x-plune-project": opts.projectId },
+    ...opts.userAgent === void 0 ? {} : { "user-agent": opts.userAgent }
+  };
+  return async function request(req) {
+    const url = buildUrl(opts.apiUrl, req);
+    let res;
+    try {
+      res = await doFetch(url.toString(), {
+        method: req.method,
+        headers: req.body === void 0 ? headers : { ...headers, "content-type": "application/json" },
+        ...req.body === void 0 ? {} : { body: JSON.stringify(req.body) },
+        // Host pinning (#1283): a redirect elsewhere would carry the token there.
+        redirect: "manual"
+      });
+    } catch {
+      throw new PluneNetworkError(apiBase(opts.apiUrl));
+    }
+    const text2 = await res.text();
+    let body = text2;
+    if (text2 !== "") {
+      try {
+        body = JSON.parse(text2);
+      } catch {
+      }
+    } else {
+      body = void 0;
+    }
+    if (res.status < 200 || res.status >= 300) throw new PluneApiError(res.status, body);
+    return { status: res.status, body };
+  };
+}
+var PluneApiError, PluneNetworkError;
+var init_client2 = __esm({
+  "src/mcp-tools/client.ts"() {
+    "use strict";
+    init_cjs_shims();
+    PluneApiError = class extends Error {
+      constructor(status, body) {
+        const error = bodyField(body, "error");
+        super(error ?? `HTTP ${status}`);
+        this.status = status;
+        this.body = body;
+        this.name = "PluneApiError";
+      }
+      status;
+      body;
+      get code() {
+        return bodyField(this.body, "code");
+      }
+    };
+    PluneNetworkError = class extends Error {
+      constructor(apiUrl) {
+        super(`could not reach Plune at ${apiUrl}`);
+        this.apiUrl = apiUrl;
+        this.name = "PluneNetworkError";
+      }
+      apiUrl;
+    };
+  }
+});
+
+// src/mcp-tools/execute.ts
+function errorOf(err) {
+  if (err instanceof PluneApiError) {
+    if (err.status === 401)
+      return { status: 401, code: "token_rejected", message: `Plune rejected the token (401): ${err.message}. Run \`plune login\` or set PLUNE_TOKEN to a live token.` };
+    if (err.status === 403 && err.message === READ_ONLY_REFUSAL)
+      return { status: 403, code: "read_only_token", message: `Plune refused (403): ${readScopeMessage("it cannot write")}` };
+    const code = err.code ?? `http_${err.status}`;
+    return { status: err.status, code, message: `Plune refused (${err.status} ${code}): ${err.message}`, details: err.body };
+  }
+  if (err instanceof PluneNetworkError) return { code: "network", message: `${err.message}. Check PLUNE_API_URL and the network.` };
+  throw err;
+}
+function isDeletion(req) {
+  if (req.method === "DELETE") return true;
+  if (asRecord(asRecord(req.body)["action"])["kind"] === "delete") return true;
+  return /\/(bulk-delete|purge|empty)$/.test(req.path);
+}
+function safePath(apiUrl, raw) {
+  if (!/^\/v1\/[^\\\s]*$/.test(raw) || raw.startsWith("//") || raw.includes("?") || raw.includes("#")) return void 0;
+  if (raw.split("/").some((s) => s === "." || s === ".." || /^%2e/i.test(s))) return void 0;
+  const base = new URL(apiUrl);
+  const url = new URL(raw, base);
+  return url.origin === base.origin && url.pathname.startsWith("/v1/") ? raw : void 0;
+}
+function createPluneToolExecutor(opts) {
+  const sessionId = opts.sessionId ?? (0, import_node_crypto5.randomUUID)();
+  const now = opts.now ?? Date.now;
+  const request = createPluneApi({ ...opts, sessionId });
+  let scope = opts.scope;
+  const revealed = /* @__PURE__ */ new Set();
+  const confirms = /* @__PURE__ */ new Map();
+  let proposals = 0;
+  const visibleTools = () => {
+    const core = defaultVisibleTools(scope);
+    const extra = [...revealed].filter((n) => !(scope === "read" && pluneTool(n).write) && !core.includes(n));
+    return [...core, ...extra];
+  };
+  async function call(req) {
+    try {
+      return await request(req);
+    } catch (err) {
+      if (err instanceof PluneApiError && err.status === 403 && err.message === READ_ONLY_REFUSAL) scope = "read";
+      throw err;
+    }
+  }
+  const planned = (req) => withoutUndefined({ method: req.method, path: req.path, query: req.query, body: req.body });
+  async function write(req, dry) {
+    if (dry === true) return { dryRun: true, request: planned(req) };
+    const res = await call(req);
+    return { dryRun: false, result: asRecord(res.body) };
+  }
+  async function batch(reqs, dry, idOf2) {
+    if (dry === true) return { dryRun: true, requested: reqs.length, applied: 0, requests: reqs.map(planned) };
+    const results = [];
+    for (const [i, req] of reqs.entries()) {
+      try {
+        const res = await call(req);
+        results.push(withoutUndefined({ ok: true, status: res.status, id: idOf2(res.body, i) }));
+      } catch (err) {
+        const e = errorOf(err);
+        if (e.code === "token_rejected" || e.code === "read_only_token" || e.code === "network") throw err;
+        results.push(withoutUndefined({ ok: false, status: e.status, error: e.message, code: e.code }));
+      }
+    }
+    return { dryRun: false, requested: reqs.length, applied: results.filter((r) => r["ok"] === true).length, results };
+  }
+  const fingerprint = (req) => JSON.stringify([req.method, req.path, req.query ?? {}, req.body ?? null]);
+  const str2 = (v) => v;
+  const handlers = {
+    async plune_project_context() {
+      const [projects, suites, cases, missions, queue] = await Promise.all([
+        call({ method: "GET", path: "/v1/projects" }),
+        call({ method: "GET", path: "/v1/suites" }),
+        call({ method: "GET", path: "/v1/test-cases", query: { limit: "1", stability: "0" } }),
+        call({ method: "GET", path: "/v1/missions" }),
+        call({ method: "GET", path: "/v1/review-items", query: { state: "pending", limit: "100" } })
+      ]);
+      const projectList = asArray(asRecord(projects.body)["projects"]);
+      const only = projectList.length === 1 ? asRecord(projectList[0])["id"] : void 0;
+      const projectId = opts.projectId ?? (typeof only === "string" ? only : null);
+      const total = asRecord(cases.body)["total"];
+      return {
+        projectId,
+        projects: projectList,
+        suites: asArray(asRecord(suites.body)["suites"]),
+        cases: { total: typeof total === "number" ? total : 0 },
+        missions: asArray(asRecord(missions.body)["missions"]),
+        reviewQueue: { pending: asArray(asRecord(queue.body)["items"]).length, more: cursorOf(asRecord(queue.body)["nextCursor"]) !== null }
+      };
+    },
+    async plune_get(i) {
+      const route = { "test-case": "/v1/test-cases/:id", run: "/v1/runs/:id", "review-item": "/v1/review-items/:id" }[str2(i["kind"])];
+      const res = await call({ method: "GET", path: path19(route, str2(i["id"])) });
+      return { kind: str2(i["kind"]), item: asRecord(res.body) };
+    },
+    async plune_cases_search(i) {
+      const query = withoutUndefined({
+        ...i["filters"],
+        limit: i["limit"] === void 0 ? void 0 : String(i["limit"]),
+        cursor: i["cursor"],
+        stability: "0"
+      });
+      const body = asRecord((await call({ method: "GET", path: "/v1/test-cases", query })).body);
+      return withoutUndefined({
+        testCases: asArray(body["testCases"]),
+        total: typeof body["total"] === "number" ? body["total"] : void 0,
+        matching: typeof body["matching"] === "number" ? body["matching"] : void 0,
+        nextCursor: cursorOf(body["nextCursor"])
+      });
+    },
+    async plune_review_list(i) {
+      const kinds = i["kinds"];
+      const query = withoutUndefined({
+        state: i["state"],
+        kind: kinds?.join(","),
+        limit: i["limit"] === void 0 ? void 0 : String(i["limit"]),
+        cursor: i["cursor"]
+      });
+      const body = asRecord((await call({ method: "GET", path: "/v1/review-items", query })).body);
+      return { items: asArray(body["items"]), nextCursor: cursorOf(body["nextCursor"]) };
+    },
+    async plune_review_decide(i) {
+      const itemIds = i["itemIds"];
+      const res = await call({
+        method: "POST",
+        path: "/v1/review-items/decisions",
+        ...i["confirm"] === void 0 ? {} : { query: { confirm: str2(i["confirm"]) } },
+        body: withoutUndefined({ itemIds, state: i["verdict"], rejectionCategory: i["rejectionCategory"], note: i["note"] })
+      });
+      const body = asRecord(res.body);
+      if (body["preview"] !== void 0) return { requested: itemIds.length, applied: 0, preview: asRecord(body["preview"]) };
+      const applied = body["applied"];
+      return { requested: itemIds.length, applied: typeof applied === "number" ? applied : 0, report: body };
+    },
+    async plune_case_propose(i) {
+      const cases = i["cases"].map((c) => {
+        const steps = c["steps"];
+        const stableId = (0, import_node_crypto5.createHash)("sha256").update([c["title"], ...steps, c["expected"]].join("\n")).digest("hex").slice(0, 32);
+        return withoutUndefined({ stableId, execution: "manual", ...c });
+      });
+      proposals += 1;
+      const req = {
+        method: "POST",
+        path: "/v1/ingest/cairn",
+        body: { schemaVersion: 1, run: { runId: `mcp-${sessionId}-${proposals}`, mode: "design", target: str2(i["target"]) }, cases }
+      };
+      if (i["dry_run"] === true) return { dryRun: true, requested: cases.length, applied: 0, requests: [planned(req)] };
+      const summary = asRecord((await call(req)).body);
+      const proposed = summary["proposed"];
+      return { dryRun: false, requested: cases.length, applied: typeof proposed === "number" ? proposed : 0, report: summary };
+    },
+    async plune_mission_create(i) {
+      const { dry_run, ...body } = i;
+      return write({ method: "POST", path: "/v1/missions", body: withoutUndefined(body) }, dry_run);
+    },
+    async plune_mission_get(i) {
+      const res = await call({ method: "GET", path: path19("/v1/missions/:id", str2(i["missionId"])) });
+      return { mission: asRecord(res.body) };
+    },
+    async plune_mission_update(i) {
+      const { dry_run, missionId: missionId2, ...body } = i;
+      return write({ method: "PATCH", path: path19("/v1/missions/:id", str2(missionId2)), body: withoutUndefined(body) }, dry_run);
+    },
+    async plune_source_add(i) {
+      const parsed = (i["kind"] === "file" ? fileSource : linkSource).safeParse(withoutUndefined(i));
+      if (!parsed.success) return fail("invalid_input", `The input does not fit: ${zodMessage(parsed.error)}`);
+      const { dry_run, missionId: missionId2, kind, ...rest } = parsed.data;
+      const req = kind === "file" ? { method: "POST", path: path19("/v1/missions/:id/files", str2(missionId2)), body: withoutUndefined(rest) } : { method: "POST", path: path19("/v1/missions/:id/sources", str2(missionId2)), body: withoutUndefined({ kind, ...rest }) };
+      return write(req, dry_run);
+    },
+    async plune_question_ask(i) {
+      const { dry_run, ...body } = i;
+      return write({ method: "POST", path: "/v1/review-items/questions", body: withoutUndefined(body) }, dry_run);
+    },
+    async plune_question_list(i) {
+      const query = withoutUndefined({
+        kind: "question",
+        state: i["state"],
+        limit: i["limit"] === void 0 ? void 0 : String(i["limit"]),
+        cursor: i["cursor"]
+      });
+      const body = asRecord((await call({ method: "GET", path: "/v1/review-items", query })).body);
+      const missionId2 = i["missionId"];
+      const questions = asArray(body["items"]).filter(
+        (item) => missionId2 === void 0 || asRecord(asRecord(item)["question"])["missionId"] === missionId2
+      );
+      return { questions, nextCursor: cursorOf(body["nextCursor"]) };
+    },
+    async plune_strategy_propose(i) {
+      return write({ method: "POST", path: path19("/v1/missions/:id/strategy", str2(i["missionId"])), body: i["content"] }, i["dry_run"]);
+    },
+    async plune_report_request(i) {
+      return write({ method: "POST", path: path19("/v1/missions/:id/report", str2(i["missionId"])), body: {} }, i["dry_run"]);
+    },
+    async plune_discover_tools(i) {
+      const names = i["names"] ?? [];
+      const unknown = names.filter((n) => !isPluneToolName(n));
+      if (unknown.length > 0) return fail("invalid_input", `No such tool: ${unknown.join(", ")}. Call this tool without names to see what there is.`);
+      const refused = names.filter((n) => scope === "read" && pluneTool(n).write);
+      if (refused.length > 0) return fail("read_only_token", readScopeMessage(`${refused.join(", ")} cannot be switched on`));
+      for (const n of names) revealed.add(n);
+      const words = (i["query"] ?? "").toLowerCase().split(/\s+/).filter(Boolean);
+      const visible = visibleTools();
+      const available = PLUNE_TOOLS.filter((t) => !visible.includes(t.name) && !(scope === "read" && t.write)).filter((t) => words.every((w) => `${t.name} ${t.title} ${t.description}`.toLowerCase().includes(w))).map((t) => ({ name: t.name, title: t.title, description: t.description, write: t.write }));
+      return { revealed: names, available, visible };
+    },
+    async plune_cases_update(i) {
+      const cases = i["cases"];
+      return batch(
+        cases.map((c) => ({ method: "PATCH", path: path19("/v1/test-cases/:id", c.id), body: c.changes })),
+        i["dry_run"],
+        (_b, n) => cases[n]?.id
+      );
+    },
+    async plune_run_create(i) {
+      return write({ method: "POST", path: "/v1/runs", body: i["run"] }, i["dry_run"]);
+    },
+    async plune_results_write(i) {
+      const results = i["results"];
+      const req = {
+        method: "POST",
+        path: path19("/v1/runs/:id/results", str2(i["runId"])),
+        body: withoutUndefined({ results, combination: i["combination"], configuration: i["configuration"] })
+      };
+      if (i["dry_run"] === true) return { dryRun: true, requested: results.length, applied: 0, requests: [planned(req)] };
+      const report = asRecord((await call(req)).body);
+      const accepted = asRecord(report["counts"])["accepted"];
+      return { dryRun: false, requested: results.length, applied: typeof accepted === "number" ? accepted : 0, report };
+    },
+    async plune_endpoint_propose(i) {
+      return batch(
+        i["endpoints"].map((e) => ({ method: "POST", path: "/v1/review-items/endpoints", body: withoutUndefined(e) })),
+        i["dry_run"],
+        (b) => asRecord(b)["id"]
+      );
+    },
+    async plune_api_request(i) {
+      const method = str2(i["method"]);
+      const p = safePath(opts.apiUrl, str2(i["path"]));
+      if (p === void 0) return fail("invalid_input", `path must be a path under /v1 on ${new URL(opts.apiUrl).origin}, e.g. /v1/suites \u2014 no host, no dot segments, no query (use query)`);
+      const query = i["query"];
+      const req = withoutUndefined({ method, path: p, query, body: i["body"] });
+      if (i["dry_run"] === true) return { dryRun: true, request: planned(req) };
+      const confirm2 = i["confirm"];
+      if (isDeletion(req)) {
+        const t = now();
+        for (const [k, v] of confirms) if (v.expires <= t) confirms.delete(k);
+        if (confirm2 === void 0) {
+          const value2 = (0, import_node_crypto5.randomBytes)(24).toString("base64url");
+          confirms.set(value2, { fingerprint: fingerprint(req), expires: t + CONFIRM_TTL_MS });
+          return {
+            preview: {
+              action: "delete",
+              method,
+              path: p,
+              confirm: value2,
+              expiresInSeconds: CONFIRM_TTL_MS / 1e3,
+              note: "Nothing was sent. Repeat the same call with confirm to send it. The platform refuses an agent any deletion (agent_cannot_delete, bulk_delete_needs_person): a person deletes from the dashboard."
+            }
+          };
+        }
+        const held = confirms.get(confirm2);
+        confirms.delete(confirm2);
+        if (held === void 0 || held.fingerprint !== fingerprint(req))
+          return fail("confirm_invalid", "confirm is unknown, expired, used, or for another request \u2014 repeat the call without it to get a new preview");
+      } else if (confirm2 !== void 0) {
+        req.query = { ...query, confirm: confirm2 };
+      }
+      const res = await call(req);
+      return { status: res.status, body: res.body };
+    }
+  };
+  return {
+    sessionId,
+    scope: () => scope,
+    visibleTools,
+    async execute(name, input) {
+      const handler = isPluneToolName(name) ? handlers[name] : void 0;
+      if (handler === void 0) return fail("unknown_tool", `No such tool: ${name}.`);
+      const tool = pluneTool(name);
+      const parsed = tool.input.safeParse(input ?? {});
+      if (!parsed.success) return fail("invalid_input", `The input does not fit: ${zodMessage(parsed.error)}`);
+      const args = parsed.data;
+      const writes = name === "plune_api_request" ? rawWrites(str2(args["method"]), str2(args["path"])) : tool.write;
+      if (writes && scope === "read" && args["dry_run"] !== true) return fail("read_only_token", readScopeMessage(`${name} is refused before any request`));
+      try {
+        const out = await handler(args);
+        return "ok" in out && typeof out["ok"] === "boolean" && ("error" in out || "data" in out) ? out : { ok: true, data: out };
+      } catch (err) {
+        return { ok: false, error: errorOf(err) };
+      }
+    }
+  };
+}
+var import_node_crypto5, CONFIRM_TTL_MS, READ_ONLY_REFUSAL, readScopeMessage, fail, zodMessage, path19, withoutUndefined, asRecord, asArray, cursorOf, rawWrites;
+var init_execute = __esm({
+  "src/mcp-tools/execute.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_crypto5 = require("crypto");
+    init_client2();
+    init_contract();
+    init_schemas();
+    CONFIRM_TTL_MS = 5 * 60 * 1e3;
+    READ_ONLY_REFUSAL = "read-only token";
+    readScopeMessage = (what) => `This token has the read scope, so ${what}. Use a token with the write scope (Plune \u2192 Account \u2192 API tokens) and restart the server.`;
+    fail = (code, message, extra = {}) => ({
+      ok: false,
+      error: { code, message, ...extra }
+    });
+    zodMessage = (error) => error.issues.map((i) => `${i.path.join(".") || "(input)"}: ${i.message}`).join("; ");
+    path19 = (template, ...ids) => {
+      let i = 0;
+      return template.replace(/:[a-z]+/gi, () => encodeURIComponent(ids[i++] ?? ""));
+    };
+    withoutUndefined = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
+    asRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
+    asArray = (v) => Array.isArray(v) ? v : [];
+    cursorOf = (v) => typeof v === "string" ? v : null;
+    rawWrites = (method, p) => method !== "GET" && !(method === "POST" && p === "/v1/test-cases/resolve");
+  }
+});
+
+// src/mcp-tools/index.ts
+var init_mcp_tools = __esm({
+  "src/mcp-tools/index.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_contract();
+    init_execute();
+    init_client2();
+    init_schemas();
+  }
+});
+
+// src/mcp/server.ts
+var server_exports = {};
+__export(server_exports, {
+  createPluneMcpServer: () => createPluneMcpServer,
+  serveStdio: () => serveStdio
+});
+function toResult(outcome) {
+  if (outcome.ok) {
+    return { content: [{ type: "text", text: JSON.stringify(outcome.data, null, 2) }], structuredContent: outcome.data };
+  }
+  return {
+    isError: true,
+    content: [{ type: "text", text: outcome.error.message }],
+    structuredContent: { error: outcome.error }
+  };
+}
+function createPluneMcpServer(opts) {
+  const { version, ...executorOptions } = opts;
+  const executor = createPluneToolExecutor({ ...executorOptions, userAgent: executorOptions.userAgent ?? `plune-cli/${version} mcp` });
+  const server = new import_mcp.McpServer({ name: "plune", version }, { capabilities: { tools: { listChanged: true } } });
+  const registered = /* @__PURE__ */ new Map();
+  const sync = () => {
+    const visible = new Set(executor.visibleTools());
+    for (const [name, tool] of registered) {
+      if (visible.has(name) && !tool.enabled) tool.enable();
+      else if (!visible.has(name) && tool.enabled) tool.disable();
+    }
+  };
+  for (const tool of PLUNE_TOOLS) {
+    if (opts.scope === "read" && tool.write) continue;
+    const handle = server.registerTool(
+      tool.name,
+      {
+        title: tool.title,
+        description: tool.description,
+        inputSchema: tool.input,
+        outputSchema: tool.output,
+        annotations: {
+          title: tool.title,
+          readOnlyHint: !tool.write,
+          destructiveHint: tool.name === "plune_api_request",
+          openWorldHint: false
+        }
+      },
+      async (args) => {
+        const outcome = await executor.execute(tool.name, args);
+        sync();
+        return toResult(outcome);
+      }
+    );
+    registered.set(tool.name, handle);
+  }
+  sync();
+  return server;
+}
+async function serveStdio(opts) {
+  const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
+  const server = createPluneMcpServer(opts);
+  const transport = new StdioServerTransport();
+  const closed = new Promise((resolve11) => {
+    transport.onclose = () => resolve11();
+  });
+  await server.connect(transport);
+  await closed;
+}
+var import_mcp;
+var init_server = __esm({
+  "src/mcp/server.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
+    init_mcp_tools();
+  }
+});
+
+// src/cli/commands/mcp.ts
+var mcp_exports = {};
+__export(mcp_exports, {
+  handleMcpServe: () => handleMcpServe
+});
+async function handleMcpServe(flags, deps) {
+  const token = (deps.loadToken ?? loadToken)();
+  if (token === null) throw new NotLoggedInError();
+  const apiUrl = resolveApiUrl(deps.apiUrl);
+  const projectId = flags.project?.trim() || process.env["PLUNE_PROJECT"]?.trim() || void 0;
+  const serve = deps.serve ?? (await Promise.resolve().then(() => (init_server(), server_exports))).serveStdio;
+  await serve({
+    token,
+    apiUrl,
+    version: deps.version,
+    ...projectId !== void 0 ? { projectId } : {},
+    ...flags.readOnly === true ? { scope: "read" } : {}
+  });
+}
+var init_mcp = __esm({
+  "src/cli/commands/mcp.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_credentials();
+    init_api_url();
+    init_sync();
+  }
+});
+
 // src/cli/commands/cairn-artifact.ts
 async function findLatestCairnRun(runsDir = "runs") {
   const entries = await fs17.readdir(runsDir, { withFileTypes: true }).catch(() => null);
@@ -6696,9 +7731,9 @@ async function findLatestCairnRun(runsDir = "runs") {
   let newest;
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const dir = path19.join(runsDir, entry.name);
+    const dir = path20.join(runsDir, entry.name);
     try {
-      const report = await fs17.lstat(path19.join(dir, "report.json"));
+      const report = await fs17.lstat(path20.join(dir, "report.json"));
       if (!report.isFile()) continue;
       if (newest === void 0 || report.mtimeMs > newest.at) {
         newest = { dir, at: report.mtimeMs };
@@ -6717,10 +7752,10 @@ async function readJson(file) {
   }
 }
 async function defaultReadEvidence(dir) {
-  const raw = await readJson(path19.join(dir, "api-evidence.json"));
+  const raw = await readJson(path20.join(dir, "api-evidence.json"));
   if (!Array.isArray(raw)) return void 0;
   return raw.map((r) => {
-    const rec = asRecord(r);
+    const rec = asRecord2(r);
     const error = str(rec["error"]);
     return { name: str(rec["name"]), passed: rec["passed"] === true, ...error !== "" ? { error } : {} };
   });
@@ -6728,7 +7763,7 @@ async function defaultReadEvidence(dir) {
 function casesFromDesign(report) {
   const list2 = Array.isArray(report["testCases"]) ? report["testCases"] : [];
   return list2.map((raw) => {
-    const c = asRecord(raw);
+    const c = asRecord2(raw);
     const steps = (Array.isArray(c["steps"]) ? c["steps"] : []).map((s) => str(s)).filter((s) => s !== "");
     return {
       stableId: str(c["stableId"]),
@@ -6744,7 +7779,7 @@ function casesFromDesign(report) {
 function casesFromApi(report, verdicts) {
   const list2 = Array.isArray(report["cases"]) ? report["cases"] : [];
   return list2.map((raw) => {
-    const c = asRecord(raw);
+    const c = asRecord2(raw);
     const name = str(c["name"], "unnamed operation");
     const request = `${str(c["method"], "GET")} ${str(c["path"], "/")}`;
     const verdict = verdicts.get(name);
@@ -6760,9 +7795,9 @@ function casesFromApi(report, verdicts) {
   });
 }
 async function readCairnRun(dir, deps = {}) {
-  const raw = await readJson(path19.join(dir, "report.json"));
+  const raw = await readJson(path20.join(dir, "report.json"));
   if (raw === void 0) throw new CairnRunNotFoundError(dir);
-  const report = asRecord(raw);
+  const report = asRecord2(raw);
   if (report["schemaVersion"] !== SUPPORTED_ARTIFACT_VERSION) {
     throw new CairnRunVersionError(report["schemaVersion"]);
   }
@@ -6790,20 +7825,20 @@ async function readCairnRun(dir, deps = {}) {
   return {
     schemaVersion: INGEST_SCHEMA_VERSION,
     run: {
-      runId: str(report["runId"], path19.basename(dir)),
+      runId: str(report["runId"], path20.basename(dir)),
       mode,
       target: str(report["url"], "unknown")
     },
     cases
   };
 }
-var fs17, path19, SUPPORTED_ARTIFACT_VERSION, INGEST_SCHEMA_VERSION, NoCairnRunsError, CairnRunNotFoundError, CairnRunVersionError, CairnRunPartialError, CairnEvidenceAmbiguousError, asRecord, str;
+var fs17, path20, SUPPORTED_ARTIFACT_VERSION, INGEST_SCHEMA_VERSION, NoCairnRunsError, CairnRunNotFoundError, CairnRunVersionError, CairnRunPartialError, CairnEvidenceAmbiguousError, asRecord2, str;
 var init_cairn_artifact = __esm({
   "src/cli/commands/cairn-artifact.ts"() {
     "use strict";
     init_cjs_shims();
     fs17 = __toESM(require("fs/promises"), 1);
-    path19 = __toESM(require("path"), 1);
+    path20 = __toESM(require("path"), 1);
     SUPPORTED_ARTIFACT_VERSION = 1;
     INGEST_SCHEMA_VERSION = 1;
     NoCairnRunsError = class extends Error {
@@ -6842,7 +7877,7 @@ var init_cairn_artifact = __esm({
         this.name = "CairnEvidenceAmbiguousError";
       }
     };
-    asRecord = (v) => typeof v === "object" && v !== null ? v : {};
+    asRecord2 = (v) => typeof v === "object" && v !== null ? v : {};
     str = (v, fallback = "") => typeof v === "string" && v !== "" ? v : fallback;
   }
 });
@@ -6875,7 +7910,7 @@ async function handleIngest(deps) {
   const doFetch = deps.fetchImpl ?? fetch;
   const endpoint = `${apiUrl}/v1/ingest/cairn`;
   const job = new JobReporter(doFetch, apiUrl, token, "ingest");
-  await job.open(path20.basename(path20.resolve(dir)), payload.cases.length);
+  await job.open(path21.basename(path21.resolve(dir)), payload.cases.length);
   try {
     const result = await upload();
     await job.uploaded({ subjectId: result.runId || void 0 });
@@ -6934,12 +7969,12 @@ function formatIngestResult(r) {
   return `${lines.join("\n")}
 `;
 }
-var path20, IngestNotLoggedInError, IngestTokenRejectedError, IngestNetworkError, IngestHttpError;
+var path21, IngestNotLoggedInError, IngestTokenRejectedError, IngestNetworkError, IngestHttpError;
 var init_ingest = __esm({
   "src/cli/commands/ingest.ts"() {
     "use strict";
     init_cjs_shims();
-    path20 = __toESM(require("path"), 1);
+    path21 = __toESM(require("path"), 1);
     init_api_url();
     init_credentials();
     init_cairn_artifact();
@@ -7374,10 +8409,10 @@ function testsOfListing(listing) {
       const annotated = spec.tests?.flatMap((t) => t.annotations ?? []).find(
         (a) => a.type === "PluneId" && a.description !== void 0 && a.description !== ""
       )?.description;
-      const id = annotated ?? TOKEN4.exec(spec.title)?.[1];
+      const id2 = annotated ?? TOKEN4.exec(spec.title)?.[1];
       const pathTitle = [...titles, spec.title].join("#");
       if (!found.has(pathTitle))
-        found.set(pathTitle, { pathTitle, ...id === void 0 ? {} : { id } });
+        found.set(pathTitle, { pathTitle, ...id2 === void 0 ? {} : { id: id2 } });
     }
     for (const child of suite.suites ?? []) walk2(child, [...titles, child.title]);
   };
@@ -7814,10 +8849,10 @@ ${missed.map((m) => `  - ${m}`).join("\n")}
     }
   });
   runCommand.command("finish").argument("<id>", "The run to close").description("Close a platform run \u2014 what the reporter tells you to do for a run left open").option("--terminate", "Record the run as cut short rather than finished", false).option("--reason <text>", "Why, for a terminated run").option("--fail-on-failures", FAIL_ON_FAILURES, false).action(
-    async (id, options, command) => {
+    async (id2, options, command) => {
       try {
         const { handleRunFinish: handleRunFinish2 } = await Promise.resolve().then(() => (init_run_lifecycle(), run_lifecycle_exports));
-        const code = await handleRunFinish2(id, {
+        const code = await handleRunFinish2(id2, {
           terminate: options.terminate,
           ...options.reason !== void 0 ? { reason: options.reason } : {},
           ...options.failOnFailures ? { failOnFailures: true } : {}
@@ -7846,10 +8881,10 @@ ${missed.map((m) => `  - ${m}`).join("\n")}
   runCommand.command("delete").argument(
     "<id>",
     "The run id \u2014 the one `plune run import` printed, or the one in the dashboard URL"
-  ).description("Delete a run and everything it produced \u2014 recoverable for 30 days").action(async (id, _options, command) => {
+  ).description("Delete a run and everything it produced \u2014 recoverable for 30 days").action(async (id2, _options, command) => {
     try {
       const { handleRunDelete: handleRunDelete2 } = await Promise.resolve().then(() => (init_run_lifecycle(), run_lifecycle_exports));
-      await handleRunDelete2(id);
+      await handleRunDelete2(id2);
     } catch (err) {
       await failRunCommand(err, verboseOf(command));
     }
@@ -7987,7 +9022,11 @@ ${missed.map((m) => `  - ${m}`).join("\n")}
       failUnexpected(err, globals.verbose === true);
     }
   });
-  program.command("diff").description("Compare two `plune run --format json` outputs and report regressions").argument("<baseline>", "Path to the baseline run JSON (e.g. from main)").argument("<current>", "Path to the current run JSON (e.g. from the PR)").option("--format <fmt>", "console | json | markdown", "console").option("--fail-on-regression", "Exit 1 when a pass\u2192fail regression is detected", false).option("-o, --output <path>", "Write the diff to a file instead of stdout").action(
+  program.command("diff").description("Compare two `plune run --format json` outputs and report regressions").argument("<baseline>", "Path to the baseline run JSON (e.g. from main)").argument("<current>", "Path to the current run JSON (e.g. from the PR)").option("--format <fmt>", "console | json | markdown", "console").option(
+    "--fail-on-regression",
+    "Exit 1 when a pass\u2192fail regression is detected, 3 when none is but an eval was not measured",
+    false
+  ).option("-o, --output <path>", "Write the diff to a file instead of stdout").action(
     async (baseline, current, options, command) => {
       const verbose = command.optsWithGlobals().verbose === true;
       const [{ handleDiff: handleDiff2, DiffInputError: DiffInputError2 }, { renderDiff: renderDiff2 }] = await Promise.all([
@@ -7997,7 +9036,9 @@ ${missed.map((m) => `  - ${m}`).join("\n")}
       try {
         const diff = handleDiff2({ baselinePath: baseline, currentPath: current });
         writeReport(renderDiff2(diff, toFormat(options.format)), options.output);
-        process.exitCode = options.failOnRegression && diff.summary.hasRegression ? 1 : 0;
+        process.exitCode = 0;
+        if (options.failOnRegression && diff.summary.hasRegression) process.exitCode = 1;
+        else if (options.failOnRegression && diff.summary.unmeasured > 0) process.exitCode = 3;
       } catch (err) {
         if (err instanceof DiffInputError2) {
           process.stderr.write(err.message + "\n");
@@ -8035,10 +9076,10 @@ ${missed.map((m) => `  - ${m}`).join("\n")}
     const { handleLogin: handleLogin2, reportLoginFailure: reportLoginFailure2 } = await Promise.resolve().then(() => (init_login(), login_exports));
     try {
       const token = options.token ?? await readTokenFromStdin();
-      const { path: path21, verified } = await handleLogin2({ token, skipVerify: options.skipVerify });
+      const { path: path22, verified } = await handleLogin2({ token, skipVerify: options.skipVerify });
       process.stdout.write(
-        verified ? `Logged in. Token checked against the API and saved to ${path21}
-` : `Token saved to ${path21} WITHOUT being checked (--skip-verify).
+        verified ? `Logged in. Token checked against the API and saved to ${path22}
+` : `Token saved to ${path22} WITHOUT being checked (--skip-verify).
 `
       );
     } catch (err) {
@@ -8055,27 +9096,46 @@ ${missed.map((m) => `  - ${m}`).join("\n")}
     const verbose = command.optsWithGlobals().verbose === true;
     const { handleLogout: handleLogout2 } = await Promise.resolve().then(() => (init_logout(), logout_exports));
     try {
-      const { removed, path: path21 } = handleLogout2();
+      const { removed, path: path22 } = handleLogout2();
       process.stdout.write(
-        removed ? `Logged out. Removed ${path21}
+        removed ? `Logged out. Removed ${path22}
 ` : "Not logged in \u2014 nothing to remove.\n"
       );
     } catch (err) {
       failUnexpected(err, verbose);
     }
   });
+  program.command("mcp").description("Plune tools for AI agents over the Model Context Protocol").command("serve").description("Serve the Plune tools over MCP stdio, for Claude Code, Codex and other MCP clients").option("--project <id>", "Project the tools work in (default: PLUNE_PROJECT, else the token's own project)").option("--read-only", "Offer only the read tools, as for a read token", false).action(async (options, command) => {
+    const verbose = command.optsWithGlobals().verbose === true;
+    const { handleMcpServe: handleMcpServe2 } = await Promise.resolve().then(() => (init_mcp(), mcp_exports));
+    const { NotLoggedInError: NotLoggedInError2 } = await Promise.resolve().then(() => (init_sync(), sync_exports));
+    try {
+      await handleMcpServe2(
+        { project: options.project, readOnly: options.readOnly },
+        { version: pkg.version }
+      );
+    } catch (err) {
+      if (err instanceof NotLoggedInError2) {
+        process.stderr.write(`plune: ${err.message}
+`);
+        process.exitCode = 2;
+        return;
+      }
+      failUnexpected(err, verbose);
+    }
+  });
   program.command("sync").description("Upload your latest local run to the Plune platform (POST /v1/runs)").option("--file <path>", "Sync a specific run JSON instead of .plune/last-run.json").option("--fail-on-failures", `${FAIL_ON_FAILURES}; read with one GET of the run's summary after the upload`, false).action(async (options, command) => {
     const globals = command.optsWithGlobals();
     const verbose = globals.verbose === true;
     const { handleSync: handleSync2, reportSyncFailure: reportSyncFailure2 } = await Promise.resolve().then(() => (init_sync(), sync_exports));
     const cwd = globals.config !== void 0 ? (0, import_node_path6.dirname)((0, import_node_path6.resolve)(globals.config)) : process.cwd();
     try {
-      const { id, url, gate, jobProblem } = await handleSync2({
+      const { id: id2, url, gate, jobProblem } = await handleSync2({
         cwd,
         ...options.file !== void 0 ? { file: options.file } : {},
         ...options.failOnFailures ? { failOnFailures: true } : {}
       });
-      process.stdout.write(`Synced run ${id} \u2192 ${url}
+      process.stdout.write(`Synced run ${id2} \u2192 ${url}
 `);
       if (jobProblem !== void 0) {
         process.stderr.write(`plune: could not report this sync to the job queue (${jobProblem}) \u2014 the run is uploaded.
@@ -8218,12 +9278,12 @@ ${missed.map((m) => `  - ${m}`).join("\n")}
   const planCommand = program.command("plan").description("Test plans on the platform \u2014 what a plan collects, as something a runner can take");
   planCommand.command("grep").argument("<id>", "The plan").description(
     "Print the plan's cases as one --grep pattern for the runner (GET /v1/plans/:id/cases)"
-  ).action(async (id, _options, command) => {
+  ).action(async (id2, _options, command) => {
     const verbose = command.optsWithGlobals().verbose === true;
     const { handlePlanGrep: handlePlanGrep2 } = await Promise.resolve().then(() => (init_plan(), plan_exports));
     const { reportCasesFailure: reportCasesFailure2 } = await Promise.resolve().then(() => (init_cases(), cases_exports));
     try {
-      const out = await handlePlanGrep2({ planId: id });
+      const out = await handlePlanGrep2({ planId: id2 });
       process.stdout.write(out.pattern + "\n");
       process.stderr.write(
         out.cases === 0 ? "plune: the plan matches no case \u2014 the pattern matches nothing.\n" : `plune: ${out.cases} case(s) in the plan, ${out.keyed} with a test key; the rest by title.