@rudderhq/cli 0.4.2 → 0.4.3-canary.1

package/dist/index.js

@@ -1623,7 +1623,7 @@ var init_organization_skill = __esm({
 
 // ../packages/shared/dist/validators/organization.js
 import { z as z11 } from "zod";
-var logoAssetIdSchema, brandColorSchema, createOrganizationSchema, updateOrganizationSchema, updateOrganizationBrandingSchema, updateOrganizationWorkspaceFileSchema, createOrganizationWorkspaceFileSchema, createOrganizationWorkspaceDirectorySchema, renameOrganizationWorkspaceEntrySchema, moveOrganizationWorkspaceEntrySchema;
+var logoAssetIdSchema, brandColorSchema, createOrganizationSchema, updateOrganizationSchema, updateOrganizationBrandingSchema, updateOrganizationWorkspaceFileSchema, createOrganizationWorkspaceFileSchema, createOrganizationWorkspaceDirectorySchema, renameOrganizationWorkspaceEntrySchema, moveOrganizationWorkspaceEntrySchema, copyOrganizationWorkspaceEntrySchema;
 var init_organization = __esm({
   "../packages/shared/dist/validators/organization.js"() {
     "use strict";
@@ -1668,6 +1668,9 @@ var init_organization = __esm({
     moveOrganizationWorkspaceEntrySchema = z11.object({
       destinationDirectoryPath: z11.string().trim().max(1e3).default("")
     });
+    copyOrganizationWorkspaceEntrySchema = z11.object({
+      destinationDirectoryPath: z11.string().trim().max(1e3).optional()
+    });
   }
 });
 
@@ -1823,13 +1826,14 @@ var init_agent = __esm({
       runtimeConfig: z13.record(z13.unknown()).optional().default({}),
       budgetMonthlyCents: z13.number().int().nonnegative().optional().default(0),
       permissions: agentPermissionsSchema.optional(),
-      metadata: z13.record(z13.unknown()).optional().nullable()
+      metadata: z13.record(z13.unknown()).optional().nullable(),
+      seedOrganizationIntelligenceDefaults: z13.boolean().optional().default(false)
     });
-    createAgentHireSchema = createAgentSchema.extend({
+    createAgentHireSchema = createAgentSchema.omit({ seedOrganizationIntelligenceDefaults: true }).extend({
       sourceIssueId: z13.string().uuid().optional().nullable(),
       sourceIssueIds: z13.array(z13.string().uuid()).optional()
     });
-    updateAgentSchema = createAgentSchema.omit({ permissions: true }).partial().extend({
+    updateAgentSchema = createAgentSchema.omit({ permissions: true, seedOrganizationIntelligenceDefaults: true }).partial().extend({
       permissions: z13.never().optional(),
       replaceAgentRuntimeConfig: z13.boolean().optional(),
       status: z13.enum(AGENT_STATUSES).optional(),
@@ -3589,7 +3593,7 @@ var init_env = __esm({
 });
 
 // src/runtime/install.ts
-import { execFileSync, spawnSync } from "node:child_process";
+import { execFileSync, spawnSync as spawnSync2 } from "node:child_process";
 import { cp, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
 import path5 from "node:path";
@@ -3697,7 +3701,7 @@ async function ensureRuntimeInstalled(options) {
       postgresPayload2
     );
   }
-  const spawnSyncImpl = options.spawnSyncImpl ?? spawnSync;
+  const spawnSyncImpl = options.spawnSyncImpl ?? spawnSync2;
   const existingRuntimeOutput = await tryRepairExistingRuntimePackage({
     spawnSyncImpl,
     cacheDir,
@@ -4446,11 +4450,11 @@ var init_server_entry = __esm({
 });
 
 // src/version.ts
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync as existsSync2, readFileSync } from "node:fs";
 import path7 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function readPackageVersion(packagePath, expectedName) {
-  if (!existsSync(packagePath)) return null;
+  if (!existsSync2(packagePath)) return null;
   try {
     const parsed = JSON.parse(readFileSync(packagePath, "utf8"));
     if (parsed.name === expectedName && parsed.version) return parsed.version;
@@ -6044,7 +6048,7 @@ var init_doctor = __esm({
 });
 
 // src/install.ts
-import { execFileSync as execFileSync2, spawnSync as spawnSync2 } from "node:child_process";
+import { execFileSync as execFileSync2, spawnSync as spawnSync3 } from "node:child_process";
 function normalizePath(value) {
   return (value ?? "").replaceAll("\\", "/").toLowerCase();
 }
@@ -6127,7 +6131,7 @@ function detectPersistentCliState(options = {}) {
   };
 }
 function installPersistentCli(options) {
-  const spawnSyncImpl = options.spawnSyncImpl ?? spawnSync2;
+  const spawnSyncImpl = options.spawnSyncImpl ?? spawnSync3;
   const command = `npm install --global ${options.installSpec}`;
   const initialResult = runNpmGlobalInstall(spawnSyncImpl, ["install", "--global", options.installSpec]);
   const initialOutput = collectSpawnOutput2(initialResult);
@@ -6815,7 +6819,8 @@ var init_onboard = __esm({
 import { Command, CommanderError } from "commander";
 
 // src/agent-v1-mcp-server.ts
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -7847,6 +7852,9 @@ function mcpBoolean(description) {
 function mcpNumber(description) {
   return { type: "number", description };
 }
+function mcpStringArray(description) {
+  return { type: "array", items: { type: "string" }, description };
+}
 function mcpInputSchemaForCapability(id) {
   const properties = {};
   const add = (key, value) => {
@@ -7861,6 +7869,9 @@ function mcpInputSchemaForCapability(id) {
   if (id.startsWith("project.")) add("project", mcpString("Project UUID or shortname."));
   if (id.startsWith("library.file.")) {
     add("path", mcpString("Library-relative file or directory path."));
+    if (id === "library.file.list") {
+      add("directory", mcpString("Library-relative directory path. Defaults to the run's project Library path when available."));
+    }
     add("body", mcpString("Direct file content for put operations."));
   }
   if (id.startsWith("approval.")) {
@@ -7883,6 +7894,7 @@ function mcpInputSchemaForCapability(id) {
   if (id.startsWith("runs.")) add("run", mcpString("Run id or short run id."));
   if (id.startsWith("agent.skills.")) {
     add("selectionRefs", { type: "array", items: { type: "string" }, description: "Skill selection refs." });
+    add("skills", { type: "array", items: { type: "string" }, description: "Skill selection refs alias." });
     add("desiredSkills", mcpString("Comma-separated desired skill refs for sync."));
   }
   for (const [key, description] of Object.entries({
@@ -7892,19 +7904,105 @@ function mcpInputSchemaForCapability(id) {
     name: "Name.",
     description: "Description or summary text.",
     status: "Status filter or new status.",
-    limit: "Page size or result limit.",
     cursor: "Pagination cursor.",
     source: "Source path or source label.",
-    kind: "Trigger kind."
+    kind: "Trigger kind.",
+    label: "Trigger label.",
+    skill: "Skill key, id, or display name.",
+    slug: "Slug.",
+    markdown: "Direct Markdown content.",
+    role: "Agent role.",
+    reportsTo: "Manager or reporting agent reference.",
+    capabilities: "Agent capability summary.",
+    wakeCommentId: "Issue comment id that triggered the wake.",
+    expectedStatuses: "Comma-separated checkout precondition statuses.",
+    after: "Pagination anchor or lower bound.",
+    order: "Sort order.",
+    priority: "Issue or automation priority.",
+    assigneeAgentId: "Target assignee agent id or reference.",
+    projectId: "Project id or reference.",
+    goalId: "Goal id or reference.",
+    parentId: "Parent issue id or reference.",
+    parentIssueId: "Parent issue id or reference.",
+    requestDepth: "Requested issue depth.",
+    billingCode: "Billing code.",
+    hiddenAt: "Hidden timestamp.",
+    archivedAt: "Archived timestamp.",
+    targetDate: "Target date.",
+    color: "Display color.",
+    scope: "Search or visibility scope.",
+    sha: "Git commit SHA.",
+    message: "Commit or status message.",
+    branch: "Git branch name.",
+    repoPath: "Repository path.",
+    workspacePath: "Workspace path.",
+    relatedAgentId: "Agent id used as a filter or related principal.",
+    leadAgentId: "Lead agent id or reference.",
+    approvalId: "Approval id or short approval id alias.",
+    automationId: "Automation id alias.",
+    chatId: "Chat conversation id alias.",
+    commentId: "Issue comment id alias.",
+    skillId: "Skill id alias.",
+    user: "User id, reference, or self.",
+    since: "Activity start timestamp.",
+    until: "Activity end timestamp.",
+    include: "Comma-separated optional data sections.",
+    content: "Direct content alias for body.",
+    roots: "Comma-separated local roots.",
+    projectIds: "Comma-separated project ids.",
+    workspaceIds: "Comma-separated workspace ids.",
+    cronExpression: "Cron expression.",
+    timezone: "Timezone.",
+    signingMode: "Webhook signing mode.",
+    replayWindowSec: "Webhook replay window in seconds.",
+    instructions: "Automation instructions.",
+    outputMode: "Automation output mode.",
+    concurrencyPolicy: "Automation concurrency policy.",
+    catchUpPolicy: "Automation catch-up policy.",
+    triggerId: "Automation trigger id.",
+    idempotencyKey: "Idempotency key.",
+    summary: "Chat summary.",
+    preferredAgentId: "Preferred responding agent id or reference.",
+    issueCreationMode: "Chat issue creation mode.",
+    editUserMessageId: "User message id to edit.",
+    updatedAfter: "Run updated-after timestamp.",
+    runIdPrefix: "Run id prefix filter.",
+    runtime: "Runtime type filter.",
+    issueId: "Issue id filter.",
+    usedSkill: "Used skill filter.",
+    loadedSkill: "Loaded skill filter.",
+    createdBefore: "Created-before timestamp.",
+    evidence: "Skill evidence type.",
+    aroundError: "Transcript error step id.",
+    maxOutputChars: "Maximum output characters."
+  })) {
+    add(key, mcpString(description));
+  }
+  for (const [key, description] of Object.entries({
+    limit: "Page size or result limit.",
+    count: "Count represented by a report.",
+    turnLimit: "Maximum turns to return.",
+    contextTurns: "Number of context turns.",
+    maxChars: "Maximum characters.",
+    snippetChars: "Maximum snippet characters."
+  })) {
+    add(key, mcpNumber(description));
+  }
+  for (const [key, description] of Object.entries({
+    selectionRefs: "Skill selection refs.",
+    selections: "Skill selection refs alias.",
+    skills: "Skill selection refs alias.",
+    images: "Local image paths to attach when supported.",
+    goalIds: "Goal ids."
   })) {
-    add(key, key === "limit" ? mcpNumber(description) : mcpString(description));
+    add(key, mcpStringArray(description));
   }
-  for (const key of ["enable", "enabled", "disabled", "reopen", "planMode", "includeTranscript", "includeOutput", "notifyOnIssueCreated"]) {
+  for (const key of ["clearTitle", "clearCapabilities", "clearDescription", "clearReportsTo", "enable", "enabled", "disabled", "reopen", "planMode", "includeTranscript", "includeOutput", "includeOutputs", "notifyOnIssueCreated", "errorsOnly", "chronological", "narrative"]) {
     add(key, mcpBoolean(`Boolean option ${key}.`));
   }
   return {
     type: "object",
-    additionalProperties: true,
+    additionalProperties: false,
     properties
   };
 }
@@ -7946,6 +8044,30 @@ function formatAgentCliCapabilitiesHumanReadable(capabilities = getAgentCliCapab
 
 // src/agent-v1-mcp-server.ts
 var RUDDER_MCP_SERVER_NAME = "rudder-control-plane";
+var RESERVED_MODEL_ARGUMENTS = /* @__PURE__ */ new Set([
+  "orgId",
+  "org_id",
+  "companyId",
+  "company_id",
+  "agentId",
+  "agent_id",
+  "runId",
+  "run_id",
+  "apiBase",
+  "api_base",
+  "apiKey",
+  "api_key",
+  "authorization"
+]);
+var NORMALIZED_RESERVED_MODEL_ARGUMENTS = /* @__PURE__ */ new Set([
+  "orgid",
+  "companyid",
+  "agentid",
+  "runid",
+  "apibase",
+  "apikey",
+  "authorization"
+]);
 function buildMcpServerEnv(env = process.env) {
   return {
     ...process.env,
@@ -7955,6 +8077,7 @@ function buildMcpServerEnv(env = process.env) {
     RUDDER_ORG_ID: env.RUDDER_ORG_ID,
     RUDDER_AGENT_ID: env.RUDDER_AGENT_ID,
     RUDDER_RUN_ID: env.RUDDER_RUN_ID,
+    RUDDER_PROJECT_LIBRARY_PATH: env.RUDDER_PROJECT_LIBRARY_PATH,
     RUDDER_MCP_RUDDER_BIN: env.RUDDER_MCP_RUDDER_BIN
   };
 }
@@ -7964,6 +8087,9 @@ function buildAgentV1ToolCallPlan(toolName, rawArgs, env = buildMcpServerEnv())
   if (!capabilityId) {
     throw new Error(`Unknown Rudder MCP tool: ${toolName}`);
   }
+  const capability = getAgentCliCapabilityById(capabilityId);
+  rejectModelProvidedRuntimeIdentity(input);
+  assertRuntimeMcpContext(capability, env);
   const tempFiles = [];
   const args = cliArgsForCapability(capabilityId, input, tempFiles, env);
   args.push("--json");
@@ -7976,7 +8102,8 @@ function buildAgentV1ToolCallPlan(toolName, rawArgs, env = buildMcpServerEnv())
       RUDDER_API_KEY: env.RUDDER_API_KEY,
       RUDDER_ORG_ID: env.RUDDER_ORG_ID,
       RUDDER_AGENT_ID: env.RUDDER_AGENT_ID,
-      RUDDER_RUN_ID: env.RUDDER_RUN_ID
+      RUDDER_RUN_ID: env.RUDDER_RUN_ID,
+      RUDDER_PROJECT_LIBRARY_PATH: env.RUDDER_PROJECT_LIBRARY_PATH
     },
     tempFiles
   };
@@ -7990,7 +8117,7 @@ async function runAgentV1McpJsonRpcMessage(message, env = buildMcpServerEnv()) {
         return isNotification ? null : rpcResult(id, {});
       case "initialize":
         return rpcResult(id, {
-          protocolVersion: "2024-11-05",
+          protocolVersion: requestedProtocolVersion(message.params) ?? "2024-11-05",
           capabilities: { tools: {} },
           serverInfo: { name: RUDDER_MCP_SERVER_NAME, version: "1.0.0" }
         });
@@ -8011,35 +8138,82 @@ async function runAgentV1McpJsonRpcMessage(message, env = buildMcpServerEnv()) {
 }
 async function runMcpStdioServer(env = buildMcpServerEnv()) {
   let buffer = "";
+  let mode = null;
   process.stdin.setEncoding("utf8");
   for await (const chunk of process.stdin) {
     buffer += chunk;
-    const lines = buffer.split(/\r?\n/);
-    buffer = lines.pop() ?? "";
-    for (const line of lines) {
-      if (!line.trim()) continue;
-      const parsed = JSON.parse(line);
-      const response = await runAgentV1McpJsonRpcMessage(parsed, env);
-      if (response) process.stdout.write(`${JSON.stringify(response)}
+    const parsed = parseMcpStdioMessages(buffer, mode);
+    mode = parsed.mode ?? mode;
+    buffer = parsed.remainder;
+    for (const message of parsed.messages) {
+      const response = await runAgentV1McpJsonRpcMessage(message, env);
+      if (!response) continue;
+      const payload = JSON.stringify(response);
+      process.stdout.write(parsed.mode === "framed" ? `Content-Length: ${Buffer.byteLength(payload, "utf8")}\r
+\r
+${payload}` : `${payload}
 `);
     }
   }
 }
+function parseMcpStdioMessages(buffer, mode = null) {
+  const messages = [];
+  const detectedMode = mode ?? detectMcpStdioMode(buffer);
+  if (!detectedMode) {
+    return { messages, remainder: buffer, mode: null };
+  }
+  if (detectedMode === "framed") {
+    let restBuffer = Buffer.from(buffer, "utf8");
+    while (true) {
+      const restText = restBuffer.toString("utf8");
+      const headerEnd = restText.indexOf("\r\n\r\n");
+      if (headerEnd < 0) break;
+      const header = restText.slice(0, headerEnd);
+      const match = /^Content-Length:\s*(\d+)\s*$/im.exec(header);
+      if (!match) break;
+      const length = Number(match[1]);
+      const bodyStart = Buffer.byteLength(restText.slice(0, headerEnd + 4), "utf8");
+      const bodyEnd = bodyStart + length;
+      if (restBuffer.byteLength < bodyEnd) break;
+      const body = restBuffer.subarray(bodyStart, bodyEnd).toString("utf8");
+      messages.push(JSON.parse(body));
+      restBuffer = restBuffer.subarray(bodyEnd);
+    }
+    return { messages, remainder: restBuffer.toString("utf8"), mode: "framed" };
+  }
+  const lines = buffer.split(/\r?\n/);
+  const remainder = lines.pop() ?? "";
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    messages.push(JSON.parse(line));
+  }
+  return { messages, remainder, mode: "newline" };
+}
+function detectMcpStdioMode(buffer) {
+  const trimmed = buffer.trimStart();
+  if (!trimmed) return null;
+  const contentLength = "Content-Length:";
+  if (contentLength.toLowerCase().startsWith(trimmed.toLowerCase())) return null;
+  if (/^Content-Length:/iu.test(trimmed)) return "framed";
+  return "newline";
+}
 async function callToolSafely(params, env) {
   try {
     return await callTool(params, env);
   } catch (err) {
     const details = errorDetails(err);
+    const payload = {
+      status: "error",
+      code: isRecord(details) && typeof details.code === "string" ? details.code : "rudder_mcp_tool_error",
+      message: errorMessage(err),
+      details: details ?? null
+    };
     return {
       content: [{
         type: "text",
-        text: JSON.stringify({
-          status: "error",
-          code: isRecord(details) && typeof details.code === "string" ? details.code : "rudder_mcp_tool_error",
-          message: errorMessage(err),
-          details: details ?? null
-        })
+        text: JSON.stringify(payload)
       }],
+      structuredContent: payload,
       isError: true
     };
   }
@@ -8062,21 +8236,25 @@ async function callTool(params, env) {
     }
     const result = await runRudderCli(materializedArgs, plan.env);
     if (result.exitCode === 0) {
+      const text6 = result.stdout.trim() || "{}";
       return {
-        content: [{ type: "text", text: result.stdout.trim() || "{}" }],
+        content: [{ type: "text", text: text6 }],
+        ...structuredContentFromJsonText(text6),
         isError: false
       };
     }
+    const payload = {
+      status: "error",
+      code: "rudder_cli_command_failed",
+      message: result.stderr.trim() || result.stdout.trim() || "Rudder CLI command failed",
+      details: { exitCode: result.exitCode }
+    };
     return {
       content: [{
         type: "text",
-        text: JSON.stringify({
-          status: "error",
-          code: "rudder_cli_command_failed",
-          message: result.stderr.trim() || result.stdout.trim() || "Rudder CLI command failed",
-          details: { exitCode: result.exitCode }
-        })
+        text: JSON.stringify(payload)
       }],
+      structuredContent: payload,
       isError: true
     };
   } finally {
@@ -8247,7 +8425,7 @@ function cliArgsForCapability(capabilityId, input, tempFiles, env) {
       return args;
     }
     case "library.file.list":
-      return ["library", "file", "list", optionalString(input.directory ?? input.path) ?? "projects"];
+      return ["library", "file", "list", optionalString(input.directory ?? input.path) ?? optionalString(env.RUDDER_PROJECT_LIBRARY_PATH) ?? "projects"];
     case "library.file.get":
       return ["library", "file", "get", requiredString(input, "path")];
     case "library.file.ref":
@@ -8468,16 +8646,16 @@ function cliArgsForCapability(capabilityId, input, tempFiles, env) {
       return args;
     }
     case "runs.get":
-      return ["runs", "get", requiredAnyString(input, ["run", "runId"])];
+      return ["runs", "get", requiredString(input, "run")];
     case "runs.events":
-      return ["runs", "events", requiredAnyString(input, ["run", "runId"])];
+      return ["runs", "events", requiredString(input, "run")];
     case "runs.log": {
-      const args = ["runs", "log", requiredAnyString(input, ["run", "runId"])];
+      const args = ["runs", "log", requiredString(input, "run")];
       pushOptional(args, "--max-chars", input.maxChars);
       return args;
     }
     case "runs.transcript": {
-      const args = ["runs", "transcript", requiredAnyString(input, ["run", "runId"])];
+      const args = ["runs", "transcript", requiredString(input, "run")];
       pushBoolean(args, "--errors-only", input.errorsOnly);
       pushOptional(args, "--around-error", input.aroundError);
       pushOptional(args, "--context-turns", input.contextTurns);
@@ -8490,14 +8668,14 @@ function cliArgsForCapability(capabilityId, input, tempFiles, env) {
       return args;
     }
     case "runs.errors": {
-      const args = ["runs", "errors", requiredAnyString(input, ["run", "runId"])];
+      const args = ["runs", "errors", requiredString(input, "run")];
       pushOptional(args, "--max-chars", input.maxChars);
       return args;
     }
     case "runs.cancel":
-      return ["runs", "cancel", requiredAnyString(input, ["run", "runId"])];
+      return ["runs", "cancel", requiredString(input, "run")];
     case "runs.retry":
-      return ["runs", "retry", requiredAnyString(input, ["run", "runId"])];
+      return ["runs", "retry", requiredString(input, "run")];
     default:
       throw new Error(`Rudder MCP tool is not implemented: ${capabilityId}`);
   }
@@ -8505,10 +8683,14 @@ function cliArgsForCapability(capabilityId, input, tempFiles, env) {
 function toMcpToolListEntry(tool) {
   return {
     name: tool.name,
-    description: `${tool.description} Mutating: ${tool.mutating ? "yes" : "no"}. Org context: ${tool.requiresOrgId ? "required" : "runtime/env"}. Agent context: ${tool.requiresAgentId ? "required" : "runtime/env"}. Run attribution: ${tool.attachesRunIdWhenAvailable ? "attached when available" : "not attached"}.`,
+    description: `${tool.description} Mutating: ${tool.mutating ? "yes" : "no"}. Runtime identity and authorization are injected by the Rudder-managed MCP server and are not accepted as tool input. Org context: ${tool.requiresOrgId ? "required from runtime env" : "not required by this tool"}. Agent context: ${tool.requiresAgentId ? "required from runtime env" : "runtime env when available"}. Run attribution: ${tool.attachesRunIdWhenAvailable ? "attached from runtime env when available" : "not attached"}.`,
     inputSchema: tool.inputSchema
   };
 }
+function requestedProtocolVersion(params) {
+  if (!isRecord(params)) return null;
+  return typeof params.protocolVersion === "string" && params.protocolVersion.trim().length > 0 ? params.protocolVersion.trim() : null;
+}
 function toolNameToCapabilityId(toolName) {
   const manifest = buildAgentV1McpToolsManifest("agent-v1");
   return manifest.tools.find((tool) => tool.name === toolName)?.id ?? null;
@@ -8578,16 +8760,46 @@ function pushRuntimeAgentArg(args, _input, env, required) {
     throw new Error("Runtime agent ID is required. Set RUDDER_AGENT_ID.");
   }
 }
+function rejectModelProvidedRuntimeIdentity(input) {
+  const reserved = Object.keys(input).filter(
+    (key) => RESERVED_MODEL_ARGUMENTS.has(key) || RESERVED_MODEL_ARGUMENTS.has(key.toLowerCase()) || NORMALIZED_RESERVED_MODEL_ARGUMENTS.has(normalizeRuntimeIdentityKey(key)) || key.toUpperCase().startsWith("RUDDER_")
+  );
+  if (reserved.length === 0) return;
+  const err = new Error(`Rudder MCP runtime identity is managed by the server; do not pass these arguments: ${reserved.sort().join(", ")}`);
+  err.code = "rudder_mcp_reserved_identity_argument";
+  throw err;
+}
+function normalizeRuntimeIdentityKey(key) {
+  return key.replace(/[^a-z0-9]/giu, "").toLowerCase();
+}
+function assertRuntimeMcpContext(capability, env) {
+  const missing = [];
+  if (!optionalString(env.RUDDER_API_URL)) missing.push("RUDDER_API_URL");
+  if (!optionalString(env.RUDDER_API_KEY)) missing.push("RUDDER_API_KEY");
+  if (capability.requiresOrgId && !optionalString(env.RUDDER_ORG_ID)) missing.push("RUDDER_ORG_ID");
+  if (capability.requiresAgentId && !optionalString(env.RUDDER_AGENT_ID)) missing.push("RUDDER_AGENT_ID");
+  if (missing.length === 0) return;
+  const err = new Error(`Rudder MCP runtime context is incomplete. Missing ${missing.join(", ")}.`);
+  err.code = "rudder_mcp_missing_runtime_context";
+  throw err;
+}
+function structuredContentFromJsonText(text6) {
+  try {
+    const parsed = JSON.parse(text6);
+    if (isRecord(parsed)) return { structuredContent: parsed };
+    return { structuredContent: { result: parsed } };
+  } catch {
+    return {};
+  }
+}
 function renderCsv(value) {
   if (!Array.isArray(value)) return value;
   return value.map((entry) => optionalString(entry)).filter(Boolean).join(",");
 }
 function runRudderCli(args, env) {
-  const command = env.RUDDER_MCP_RUDDER_BIN || process.execPath;
-  const modulePath = fileURLToPath(new URL("./index.js", import.meta.url));
-  const commandArgs = env.RUDDER_MCP_RUDDER_BIN ? args : [modulePath, ...args];
+  const invocation = resolveRudderCliInvocation(args, env);
   return new Promise((resolve) => {
-    const child = spawn(command, commandArgs, { env, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn(invocation.command, invocation.args, { env, stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     child.stdout?.on("data", (chunk) => {
@@ -8600,6 +8812,30 @@ function runRudderCli(args, env) {
     child.on("error", (err) => resolve({ exitCode: 1, stdout, stderr: err.message }));
   });
 }
+function resolveRudderCliInvocation(args, env) {
+  if (env.RUDDER_MCP_RUDDER_BIN) {
+    return { command: env.RUDDER_MCP_RUDDER_BIN, args };
+  }
+  const modulePath = fileURLToPath(new URL("./index.js", import.meta.url));
+  if (existsSync(modulePath)) {
+    return { command: process.execPath, args: [modulePath, ...args] };
+  }
+  if (hasRunnableRudderOnPath(env)) {
+    return { command: "rudder", args };
+  }
+  return {
+    command: process.execPath,
+    args: [modulePath, ...args]
+  };
+}
+function hasRunnableRudderOnPath(env) {
+  const probe = spawnSync("rudder", ["--version"], {
+    env,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  return !probe.error;
+}
 function rpcResult(id, result) {
   return { jsonrpc: "2.0", id, result };
 }
@@ -9524,10 +9760,11 @@ var RUDDER_AGENT_OPERATING_CONTRACT = [
   "- Project Library locator lives in `$RUDDER_PROJECT_LIBRARY_PATH` when the run has project context, for example `projects/<project-key>`.",
   '- Library-backed project resources use `sourceType: "library"`; their `locator` points into `library:projects/<project-key>/`.',
   "- Project Context is explicit operator-curated context, not the whole knowledge boundary. When it is insufficient, inspect broader Library and org workspace know-how before concluding context is missing.",
-  "- In local trusted runs, durable generated project work files should be written directly under `$RUDDER_PROJECT_LIBRARY_ROOT` with normal filesystem tools.",
+  "- In local trusted runs, durable generated project work files should be written directly under `$RUDDER_PROJECT_LIBRARY_ROOT` with normal filesystem tools when the run has project context.",
   "- `library:projects/<project-key>/...` is the Rudder product locator for those files, not the Markdown link syntax and not a reason to route ordinary local edits through the CLI.",
-  '- When you create or update a durable Library file, always include a user-visible Markdown link to that file in your final chat reply or issue comment. Use `rudder library file ref "$RUDDER_PROJECT_LIBRARY_PATH/<relative-file>" --json` and paste the returned `markdownLink`; do not pass the absolute `$RUDDER_PROJECT_LIBRARY_ROOT/...` path to `ref`, and do not hand-write `library-entry://...` or `library-file://...` links.',
-  '- If `$RUDDER_PROJECT_LIBRARY_ROOT` is unset or inaccessible, use `rudder library file get/put "$RUDDER_PROJECT_LIBRARY_PATH/<relative-file>"` as the remote or restricted runtime fallback.',
+  "- When there is no project context, durable generated chat/work artifacts belong under the organization Library artifacts fallback: `$RUDDER_ORG_WORKSPACE_ROOT/artifacts/YYYY-MM-DD/<conversation-title>/<relative-file>` and product locator `library:artifacts/YYYY-MM-DD/<conversation-title>/<relative-file>`. Use the current date and a concise slug of the current chat/thread title for `<conversation-title>`. Do not choose an existing project, such as Getting Started, just to obtain a project Library path.",
+  '- When you create or update a durable Library file, always include a user-visible Markdown link to that file in your final chat reply or issue comment. With project context, use `rudder library file ref "$RUDDER_PROJECT_LIBRARY_PATH/<relative-file>" --json`; without project context, use `rudder library file ref "artifacts/YYYY-MM-DD/<conversation-title>/<relative-file>" --json`. Paste the returned `markdownLink`; do not pass absolute filesystem paths to `ref`, and do not hand-write `library-entry://...` or `library-file://...` links.',
+  '- If `$RUDDER_PROJECT_LIBRARY_ROOT` is unset or inaccessible but `$RUDDER_PROJECT_LIBRARY_PATH` exists, use `rudder library file get/put "$RUDDER_PROJECT_LIBRARY_PATH/<relative-file>"` as the remote or restricted runtime fallback. If there is no project context, use the organization artifacts fallback path instead.',
   "- Use `$RUDDER_RUNTIME_TMPDIR` for transient scratch files and temporary verification files when it is set; otherwise use `/tmp`. Do not put durable work product there.",
   "- Local trusted runtimes may expose the host operator home as `$RUDDER_OPERATOR_HOME`; use it only when a local skill or script intentionally needs operator-owned desktop app or CLI state. Do not replace `$HOME` with it.",
   "",
@@ -9546,7 +9783,7 @@ var RUDDER_AGENT_OPERATING_CONTRACT = [
   "- Projects: use `[](project://<project-id>)` when citing a Rudder project.",
   "- Chat threads: use `[](chat://<conversation-id>)` when citing a Rudder chat conversation.",
   "- Skills: use `[](skill://<skill-ref>)` when citing a Rudder skill reference. The skill ref may be an org skill, agent skill, bundled Rudder skill, or local-machine skill ref; the UI resolves the display label when metadata is available.",
-  '- Library files: use the `markdownLink` returned by `rudder library file ref "$RUDDER_PROJECT_LIBRARY_PATH/<relative-file>" --json`; do not hand-write `library-entry://...` links, and treat `library-file://...` as legacy path syntax only.',
+  '- Library files: use the `markdownLink` returned by `rudder library file ref "$RUDDER_PROJECT_LIBRARY_PATH/<relative-file>" --json` with project context, or `rudder library file ref "artifacts/YYYY-MM-DD/<conversation-title>/<relative-file>" --json` without project context; do not hand-write `library-entry://...` links, and treat `library-file://...` as legacy path syntax only.',
   "",
   "Write these as normal Markdown links, not inside code spans or code blocks, unless you are literally documenting the syntax.",
   "",
@@ -14891,7 +15128,7 @@ init_home();
 init_install2();
 init_install();
 import * as p15 from "@clack/prompts";
-import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
+import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { createWriteStream, constants as fsConstants, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
 import { access, chmod, copyFile, cp as cp2, mkdir as mkdir3, mkdtemp, readdir as readdir3, readFile as readFile6, rm as rm2, stat as stat4, utimes, writeFile as writeFile3 } from "node:fs/promises";
@@ -15748,7 +15985,7 @@ async function withDesktopInstallLock(paths, fn, options = {}) {
   }
 }
 function runChecked(command, args, options = {}) {
-  const result = spawnSync3(command, args, {
+  const result = spawnSync4(command, args, {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
     ...options
@@ -15835,7 +16072,7 @@ function isInstalledDesktopCurrent(metadata, releaseTag, assetName, assetChecksu
 }
 function forceQuitDesktopProcess(pid, target) {
   if (target.platform === "windows") {
-    spawnSync3("taskkill.exe", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore" });
+    spawnSync4("taskkill.exe", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore" });
     return;
   }
   try {
@@ -15848,7 +16085,7 @@ function quotePowerShellString(value) {
 }
 function findDesktopExecutablePids(executablePath, target) {
   if (target.platform === "windows") {
-    const result2 = spawnSync3("powershell.exe", [
+    const result2 = spawnSync4("powershell.exe", [
       "-NoProfile",
       "-Command",
       `Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -eq ${quotePowerShellString(executablePath)} } | Select-Object -ExpandProperty ProcessId`
@@ -15859,7 +16096,7 @@ function findDesktopExecutablePids(executablePath, target) {
     if (result2.status !== 0) return [];
     return result2.stdout.split(/\r?\n/).map((line) => Number.parseInt(line.trim(), 10)).filter((pid) => Number.isInteger(pid) && pid > 0 && pid !== process.pid);
   }
-  const result = spawnSync3("ps", ["-eo", "pid=,args="], {
+  const result = spawnSync4("ps", ["-eo", "pid=,args="], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"]
   });
@@ -15886,7 +16123,7 @@ async function waitForUpdateQuitResponse(responsePath, timeoutMs = 8e3) {
 async function requestDesktopQuit(executablePath, target, options = {}) {
   if (!await pathExists2(executablePath)) return { ok: true, status: "not_running" };
   const responsePath = path22.join(tmpdir(), `rudder-update-quit-${process.pid}-${Date.now()}.json`);
-  const result = spawnSync3(executablePath, [
+  const result = spawnSync4(executablePath, [
     `${DESKTOP_UPDATE_QUIT_ARG}=${responsePath}`,
     ...options.forceUpdate ? [DESKTOP_UPDATE_FORCE_ARG] : []
   ], {
@@ -16065,7 +16302,7 @@ async function copyPortableAppBundle(sourcePath, destinationPath) {
   if (process.platform === "win32") {
     await mkdir3(destinationPath, { recursive: true });
     const command = buildWindowsRobocopyMirrorCommand(sourcePath, destinationPath);
-    const result = spawnSync3(command.command, command.args, {
+    const result = spawnSync4(command.command, command.args, {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -16076,7 +16313,7 @@ async function copyPortableAppBundle(sourcePath, destinationPath) {
 }
 async function removeMacQuarantine(paths, target) {
   if (target.platform !== "macos") return;
-  const result = spawnSync3("xattr", ["-dr", "com.apple.quarantine", paths.appPath], { stdio: "ignore" });
+  const result = spawnSync4("xattr", ["-dr", "com.apple.quarantine", paths.appPath], { stdio: "ignore" });
   if (result.status !== 0) {
     p15.log.warn(`Could not remove macOS quarantine attributes from ${paths.appPath}.`);
   }
@@ -16125,7 +16362,7 @@ async function createPlatformLaunchers(paths, target) {
     return;
   }
   if (target.platform === "windows") {
-    const result = spawnSync3("powershell.exe", [
+    const result = spawnSync4("powershell.exe", [
       "-NoProfile",
       "-ExecutionPolicy",
       "Bypass",