@sakupa/mcp 0.7.32 → 0.7.34

package/dist/index.js

@@ -124,7 +124,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.32";
+var SAKUPA_MCP_VERSION = "0.7.34";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -1217,7 +1217,7 @@ function normalizeOutputDir(outputDir) {
   return normalized === "" ? "." : normalized;
 }
 async function analyzeProject(projectDir, opts = {}) {
-  const root = resolve(projectDir);
+  const root = await fs.realpath(resolve(projectDir));
   const pkg = await readPackageJson(root);
   const detection = await detectFramework(root, pkg);
   const ssrRisks = [...detection?.ssrRisks ?? []];
@@ -1233,6 +1233,16 @@ async function analyzeProject(projectDir, opts = {}) {
       outputDirExists = false;
     } else {
       outputDirExists = await isDirectory(abs) || outputDirRel === "." && await isDirectory(root);
+      if (outputDirExists) {
+        try {
+          const physical = await fs.realpath(abs);
+          if (physical !== root && !physical.startsWith(root + sep)) {
+            outputDirExists = false;
+          }
+        } catch {
+          outputDirExists = false;
+        }
+      }
     }
   } else if (detection) {
     for (const candidate of detection.outputCandidates) {
@@ -1354,11 +1364,186 @@ async function analyzeProject(projectDir, opts = {}) {
   };
 }
 
-// src/tools/context.ts
-import { z as z2 } from "zod";
-import { statSync } from "node:fs";
+// src/project-root.ts
+import { randomUUID } from "node:crypto";
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync2,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  realpathSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute, parse, resolve as resolve2 } from "node:path";
+import { isAbsolute, join as join3, parse, relative, resolve as resolve2, sep as sep2 } from "node:path";
+var SAKUPA_DIR = ".sakupa";
+var PROJECT_FILE = "project.json";
+var PROJECT_SCHEMA_VERSION = 1;
+var ProjectRootError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ProjectRootError";
+    this.code = code;
+  }
+};
+function projectMarkerPath(projectDir) {
+  return join3(projectDir, SAKUPA_DIR, PROJECT_FILE);
+}
+function loadProjectMarker(projectDir) {
+  const path = projectMarkerPath(projectDir);
+  if (!existsSync2(path)) return { kind: "absent" };
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(path, "utf8"));
+  } catch (error) {
+    return {
+      kind: "corrupted",
+      problem: `the file cannot be read as JSON (${error instanceof Error ? error.message : String(error)})`
+    };
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return { kind: "corrupted", problem: "the file does not contain a JSON object" };
+  }
+  const record = parsed;
+  if (record.schemaVersion !== PROJECT_SCHEMA_VERSION) {
+    return {
+      kind: "corrupted",
+      problem: `unsupported schemaVersion ${String(record.schemaVersion)}`
+    };
+  }
+  if (typeof record.projectId !== "string" || !isUuid(record.projectId)) {
+    return { kind: "corrupted", problem: "projectId is missing or is not a UUID" };
+  }
+  if (typeof record.createdAt !== "string" || !Number.isFinite(Date.parse(record.createdAt))) {
+    return { kind: "corrupted", problem: "createdAt is missing or invalid" };
+  }
+  if (record.outputDir !== void 0 && (typeof record.outputDir !== "string" || !isSafeRelativeOutput(record.outputDir))) {
+    return { kind: "corrupted", problem: "outputDir is not a safe project-relative path" };
+  }
+  return {
+    kind: "ok",
+    marker: {
+      schemaVersion: PROJECT_SCHEMA_VERSION,
+      projectId: record.projectId,
+      createdAt: record.createdAt,
+      ...record.outputDir !== void 0 ? { outputDir: normalizeRelative(record.outputDir) } : {}
+    }
+  };
+}
+function resolveLockedProjectRoot(projectDir) {
+  const canonical = canonicalProjectDirectory(projectDir);
+  assertSafeProjectRoot(canonical);
+  const markerState = loadProjectMarker(canonical);
+  if (markerState.kind === "corrupted") {
+    throw new ProjectRootError(
+      "corrupted_marker",
+      `Sakupa project marker ${projectMarkerPath(canonical)} is damaged: ${markerState.problem}.`
+    );
+  }
+  if (markerState.kind === "absent") {
+    throw new ProjectRootError(
+      "not_initialized",
+      `The MCP working directory ${canonical} is not initialized. Run \`npx -y @sakupa/mcp@latest init\` in that directory; do not pass a path argument.`
+    );
+  }
+  return {
+    projectDir: canonical,
+    requestedPath: canonical,
+    markerKind: "project",
+    marker: markerState.marker
+  };
+}
+function updateProjectOutputDir(projectDir, outputDir) {
+  const canonical = canonicalProjectDirectory(projectDir);
+  const state = loadProjectMarker(canonical);
+  if (state.kind !== "ok") {
+    throw new ProjectRootError(
+      state.kind === "corrupted" ? "corrupted_marker" : "not_initialized",
+      state.kind === "corrupted" ? `Cannot update damaged Sakupa project marker: ${state.problem}.` : `No Sakupa project marker exists in ${canonical}.`
+    );
+  }
+  if (!isSafeRelativeOutput(outputDir)) {
+    throw new ProjectRootError(
+      "unsafe_path",
+      `Output directory "${outputDir}" must stay inside the initialized Sakupa project.`
+    );
+  }
+  const marker = {
+    ...state.marker,
+    outputDir: normalizeRelative(outputDir)
+  };
+  writeMarkerAtomically(canonical, marker);
+  return marker;
+}
+function canonicalProjectDirectory(path) {
+  const canonical = canonicalExistingPath(resolve2(path));
+  if (!statSync(canonical).isDirectory()) {
+    throw new ProjectRootError("invalid_path", `Project path ${canonical} is not a directory.`);
+  }
+  return canonical;
+}
+function canonicalExistingPath(path) {
+  try {
+    const stat2 = lstatSync(path, { throwIfNoEntry: false });
+    if (!stat2) {
+      throw new ProjectRootError("invalid_path", `Project path ${path} does not exist.`);
+    }
+    return realpathSync(path);
+  } catch (error) {
+    if (error instanceof ProjectRootError) throw error;
+    throw new ProjectRootError(
+      "invalid_path",
+      `Project path ${path} cannot be resolved (${error instanceof Error ? error.message : String(error)}).`
+    );
+  }
+}
+function assertSafeProjectRoot(projectDir) {
+  if (parse(projectDir).root === projectDir || projectDir === realpathSync(homedir())) {
+    throw new ProjectRootError(
+      "unsafe_path",
+      `Refusing to use ${projectDir} as a Sakupa project root; choose a specific project directory.`
+    );
+  }
+}
+function isUuid(value) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+}
+function normalizeRelative(path) {
+  const normalized = path.split(sep2).join("/").replace(/^\.\//, "").replace(/\/$/, "");
+  return normalized.length === 0 ? "." : normalized;
+}
+function isSafeRelativeOutput(path) {
+  if (path.length === 0 || isAbsolute(path)) return false;
+  const normalized = normalizeRelative(path);
+  if (normalized === ".") return true;
+  const rel = relative("/sakupa-root", resolve2("/sakupa-root", normalized));
+  return rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute(rel);
+}
+function writeMarkerAtomically(projectDir, marker) {
+  const dir = join3(projectDir, SAKUPA_DIR);
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  const path = projectMarkerPath(projectDir);
+  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync2(temporary, `${JSON.stringify(marker, null, 2)}
+`, {
+      encoding: "utf8",
+      mode: 384
+    });
+    renameSync(temporary, path);
+    try {
+      chmodSync2(path, 384);
+    } catch {
+    }
+  } finally {
+    if (existsSync2(temporary)) unlinkSync(temporary);
+  }
+}
 
 // src/tools/result.ts
 import { z } from "zod";
@@ -1407,37 +1592,25 @@ var LocalGuidanceError = class extends SakupaError {
     super(code, message);
   }
 };
-var projectDirInput = z2.string().describe(
-  "REQUIRED on every call: absolute path of the user's PROJECT ROOT \u2014 the folder the user opened/works in (for framework projects: where package.json lives, NEVER the build-output subfolder like dist/out; the analyzer locates the output automatically). .sakupa/site.json lives here, so PASS THE SAME DIRECTORY EVERY TIME for the same project. Only YOU know which directory the user is in \u2014 the server never guesses and refuses calls without it."
-);
-function withProjectDir(ctx, projectDirArg) {
-  if (projectDirArg === void 0) {
-    throw new LocalGuidanceError(
-      "invalid_request",
-      "projectDir is REQUIRED on every call: pass the absolute path of the directory the user is CURRENTLY working in. The server never guesses a directory \u2014 a wrong guess once published one project's files over a different project's PAID site."
-    );
-  }
-  if (!isAbsolute(projectDirArg)) {
-    throw new LocalGuidanceError(
-      "invalid_request",
-      `projectDir must be an ABSOLUTE path (got "${projectDirArg}"). Pass the full path of the directory the user is currently working in.`
-    );
-  }
-  const dir = resolve2(projectDirArg);
-  if (parse(dir).root === dir || dir === homedir()) {
-    throw new LocalGuidanceError(
-      "invalid_request",
-      `projectDir "${dir}" is a filesystem root or the home directory. Pass the specific project folder that holds the site's files, not a top-level directory.`
-    );
-  }
-  const stat2 = statSync(dir, { throwIfNoEntry: false });
-  if (!stat2?.isDirectory()) {
-    throw new LocalGuidanceError(
-      "invalid_request",
-      `projectDir "${dir}" does not exist or is not a directory. Pass the absolute path of the directory the user is currently working in.`
-    );
+function withProjectDir(ctx) {
+  try {
+    const resolved = resolveLockedProjectRoot(ctx.projectDir);
+    return {
+      ...ctx,
+      projectDir: resolved.projectDir,
+      requestedPath: resolved.requestedPath,
+      markerKind: resolved.markerKind,
+      projectMarker: resolved.marker
+    };
+  } catch (error) {
+    if (error instanceof ProjectRootError) {
+      throw new LocalGuidanceError(
+        error.code === "not_initialized" ? "not_found" : "invalid_request",
+        error.message
+      );
+    }
+    throw error;
   }
-  return { ...ctx, projectDir: dir };
 }
 function requireSiteFile(ctx) {
   const state = loadSiteFile(ctx.projectDir);
@@ -1450,7 +1623,7 @@ function requireSiteFile(ctx) {
   if (state.kind === "absent") {
     throw new LocalGuidanceError(
       "not_found",
-      `No .sakupa/site.json found in ${ctx.projectDir} \u2014 this directory has no Sakupa site binding. If you meant to manage (delete/status/bind) an EXISTING site, re-run this tool with projectDir set to THAT site's own directory (each site's binding lives in its own folder). To publish THIS directory as a new site, run deploy. If this was a paid custom-domain site whose project file was lost, use recover.`
+      `No .sakupa/site.json found in ${ctx.projectDir} \u2014 this directory has no Sakupa site binding. If you meant to manage a different existing site, open that project as the AI tool workspace and start its Sakupa MCP process there. To publish THIS directory as a new site, run deploy. If this was a paid custom-domain site whose project file was lost, use recover.`
     );
   }
   return state.file;
@@ -1494,14 +1667,15 @@ function toolError(e) {
 }
 
 // src/tools/definitions.ts
-import { randomUUID } from "node:crypto";
-import { existsSync as existsSync3, promises as fs2 } from "node:fs";
-import { join as join5, relative as relative2, resolve as resolve4, sep as sep3 } from "node:path";
-import { z as z3 } from "zod";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { promises as fs2 } from "node:fs";
+import { join as join6, resolve as resolve4 } from "node:path";
+import { z as z2 } from "zod";
 
 // src/recovery-archive.ts
+import { existsSync as existsSync3, realpathSync as realpathSync2 } from "node:fs";
 import { mkdtemp, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import { dirname as dirname2, isAbsolute as isAbsolute2, join as join3, relative, resolve as resolve3, sep as sep2 } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join4, relative as relative2, resolve as resolve3, sep as sep3 } from "node:path";
 
 // ../../node_modules/fflate/esm/index.mjs
 import { createRequire } from "module";
@@ -1920,15 +2094,15 @@ function strFromU8(dat, latin1) {
 var slzh = function(d, b) {
   return b + 30 + b2(d, b + 26) + b2(d, b + 28);
 };
-var zh = function(d, b, z6) {
+var zh = function(d, b, z5) {
   var fnl = b2(d, b + 28), efl = b2(d, b + 30), fn = strFromU8(d.subarray(b + 46, b + 46 + fnl), !(b2(d, b + 8) & 2048)), es = b + 46 + fnl;
-  var _a2 = z64hs(d, es, efl, z6, b4(d, b + 20), b4(d, b + 24), b4(d, b + 42)), sc = _a2[0], su = _a2[1], off = _a2[2];
+  var _a2 = z64hs(d, es, efl, z5, b4(d, b + 20), b4(d, b + 24), b4(d, b + 42)), sc = _a2[0], su = _a2[1], off = _a2[2];
   return [b2(d, b + 10), sc, su, fn, es + efl + b2(d, b + 32), off];
 };
-var z64hs = function(d, b, l, z6, sc, su, off) {
+var z64hs = function(d, b, l, z5, sc, su, off) {
   var nsc = sc == 4294967295, nsu = su == 4294967295, noff = off == 4294967295, e = b + l;
   var nf = nsc + nsu + noff;
-  if (z6 && nf) {
+  if (z5 && nf) {
     for (; b + 4 < e; b += 4 + b2(d, b + 2)) {
       if (b2(d, b) == 1) {
         return [
@@ -1939,7 +2113,7 @@ var z64hs = function(d, b, l, z6, sc, su, off) {
         ];
       }
     }
-    if (z6 < 2)
+    if (z5 < 2)
       err(13);
   }
   return [sc, su, off, 0];
@@ -1956,18 +2130,18 @@ function unzipSync(data, opts) {
   if (!c)
     return {};
   var o = b4(data, e + 16);
-  var z6 = b4(data, e - 20) == 117853008;
-  if (z6) {
+  var z5 = b4(data, e - 20) == 117853008;
+  if (z5) {
     var ze = b4(data, e - 12);
-    z6 = b4(data, ze) == 101075792;
-    if (z6) {
+    z5 = b4(data, ze) == 101075792;
+    if (z5) {
       c = b4(data, ze + 32);
       o = b4(data, ze + 48);
     }
   }
   var fltr = opts && opts.filter;
   for (var i = 0; i < c; ++i) {
-    var _a2 = zh(data, o, z6), c_2 = _a2[0], sc = _a2[1], su = _a2[2], fn = _a2[3], no = _a2[4], off = _a2[5], b = slzh(data, off);
+    var _a2 = zh(data, o, z5), c_2 = _a2[0], sc = _a2[1], su = _a2[2], fn = _a2[3], no = _a2[4], off = _a2[5], b = slzh(data, off);
     o = no;
     if (!fltr || fltr({
       name: fn,
@@ -1991,15 +2165,30 @@ function safeOutputPath(projectDir, outputDir) {
   if (outputDir.length === 0 || isAbsolute2(outputDir)) {
     throw new SakupaError("invalid_request", "Recovery outputDir must be a relative directory");
   }
-  const root = resolve3(projectDir);
+  const root = realpathSync2(resolve3(projectDir));
   const target = resolve3(root, outputDir);
-  const rel = relative(root, target);
-  if (rel === "" || rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute2(rel)) {
+  const rel = relative2(root, target);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep3}`) || isAbsolute2(rel)) {
     throw new SakupaError("invalid_request", "Recovery outputDir must stay inside projectDir");
   }
-  if (rel === ".sakupa" || rel.startsWith(`.sakupa${sep2}`)) {
+  if (rel === ".sakupa" || rel.startsWith(`.sakupa${sep3}`)) {
     throw new SakupaError("invalid_request", "Recovery content cannot be written inside .sakupa");
   }
+  let existingAncestor = target;
+  while (!existsSync3(existingAncestor)) {
+    const parent = dirname2(existingAncestor);
+    if (parent === existingAncestor) break;
+    existingAncestor = parent;
+  }
+  const physicalAncestor = realpathSync2(existingAncestor);
+  const physicalTarget = resolve3(physicalAncestor, relative2(existingAncestor, target));
+  const physicalRel = relative2(root, physicalTarget);
+  if (physicalRel === ".." || physicalRel.startsWith(`..${sep3}`) || isAbsolute2(physicalRel)) {
+    throw new SakupaError(
+      "invalid_request",
+      "Recovery outputDir resolves through a symlink outside projectDir"
+    );
+  }
   return target;
 }
 function safeEntryName(name) {
@@ -2028,9 +2217,9 @@ async function listExistingFiles(root, current = root) {
     if (entry.isSymbolicLink()) {
       throw new SakupaError("state_conflict", `Recovery output contains a symlink: ${entry.name}`);
     }
-    const absolute = join3(current, entry.name);
+    const absolute = join4(current, entry.name);
     if (entry.isDirectory()) files.push(...await listExistingFiles(root, absolute));
-    else if (entry.isFile()) files.push(relative(root, absolute).split(sep2).join("/"));
+    else if (entry.isFile()) files.push(relative2(root, absolute).split(sep3).join("/"));
     else
       throw new SakupaError(
         "state_conflict",
@@ -2046,7 +2235,7 @@ async function existingOutputMatches(outputDir, files) {
     return false;
   }
   for (const name of expected) {
-    const actual = await readFile(join3(outputDir, ...name.split("/")));
+    const actual = await readFile(join4(outputDir, ...name.split("/")));
     const wanted = files[name];
     if (!wanted || actual.byteLength !== wanted.byteLength || !actual.equals(wanted)) return false;
   }
@@ -2056,7 +2245,7 @@ async function extractRecoveryArchive(input) {
   if (!Number.isSafeInteger(input.expectedBytes) || input.expectedBytes < 0 || input.expectedBytes > PAID_SITE_MAX_TOTAL_BYTES || !Number.isSafeInteger(input.expectedFiles) || input.expectedFiles < 0 || input.expectedFiles > MAX_FILE_COUNT) {
     throw new SakupaError("validation_failed", "Recovery archive metadata exceeds product limits");
   }
-  const outputDir = safeOutputPath(input.projectDir, input.outputDir ?? "html");
+  const outputDir = safeOutputPath(input.projectDir, input.outputDir);
   const maxArchiveBytes = input.expectedBytes + input.expectedFiles * 4096 + 65536;
   if (input.archive.byteLength > maxArchiveBytes) {
     throw new SakupaError("validation_failed", "Recovery archive is larger than its site metadata");
@@ -2097,13 +2286,13 @@ async function extractRecoveryArchive(input) {
       `Recovery output already exists with different content: ${outputDir}. Move it aside or choose another outputDir.`
     );
   }
-  const tempDir = await mkdtemp(join3(resolve3(input.projectDir), ".sakupa-restore-"));
+  const tempDir = await mkdtemp(join4(resolve3(input.projectDir), ".sakupa-restore-"));
   try {
     let writtenBytes = 0;
     const entries = Object.entries(files).sort(([a], [b]) => a.localeCompare(b));
     for (const [rawName, data] of entries) {
       const name = safeEntryName(rawName);
-      const destination = join3(tempDir, ...name.split("/"));
+      const destination = join4(tempDir, ...name.split("/"));
       await mkdir(dirname2(destination), { recursive: true });
       await writeFile(destination, data, { flag: "wx" });
       writtenBytes += data.byteLength;
@@ -2129,19 +2318,19 @@ async function extractRecoveryArchive(input) {
 }
 
 // src/creation-registry.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname3, join as join4 } from "node:path";
+import { dirname as dirname3, join as join5 } from "node:path";
 var RECENT_WINDOW_MS = FREE_SITE_TTL_HOURS * 60 * 60 * 1e3;
 function creationRegistryPath() {
   const base = process.env["SAKUPA_STATE_DIR"] ?? homedir2();
-  return join4(base, ".sakupa", "created-sites.json");
+  return join5(base, ".sakupa", "created-sites.json");
 }
 function readAll() {
   const path = creationRegistryPath();
-  if (!existsSync2(path)) return [];
+  if (!existsSync4(path)) return [];
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync3(path, "utf-8"));
     if (!Array.isArray(parsed)) return [];
     return parsed.filter(
       (e) => typeof e === "object" && e !== null && typeof e.siteId === "string" && typeof e.createdAt === "string"
@@ -2152,8 +2341,8 @@ function readAll() {
 }
 function writeAll(records) {
   const path = creationRegistryPath();
-  mkdirSync2(dirname3(path), { recursive: true });
-  writeFileSync2(path, `${JSON.stringify(records, null, 2)}
+  mkdirSync3(dirname3(path), { recursive: true });
+  writeFileSync3(path, `${JSON.stringify(records, null, 2)}
 `, "utf-8");
 }
 function listRecentCreations(nowMs, apiBaseUrl) {
@@ -2328,12 +2517,12 @@ ${JSON.stringify(obj, null, 2)}`;
     nextActions: []
   });
 }
-var planEnum = z3.enum(["water", "personal", "share", "business"]);
-var severityEnum = z3.enum(["low", "medium", "high", "critical"]);
+var planEnum = z2.enum(["water", "personal", "share", "business"]);
+var severityEnum = z2.enum(["low", "medium", "high", "critical"]);
 function planCatalog() {
   return TIER_ORDER.map((p) => `${p} JPY ${tierPriceJpy(p)}/month`).join(", ");
 }
-var ticketCategoryEnum = z3.enum([
+var ticketCategoryEnum = z2.enum([
   "billing",
   "payment",
   "refund_review",
@@ -2381,7 +2570,7 @@ function ensureUploadSizeWithinLimits(manifest, isFirstFreeDeploy) {
 async function buildHashedManifest(files, outputAbs) {
   const manifest = [];
   for (const file of files) {
-    const bytes = new Uint8Array(await fs2.readFile(join5(outputAbs, file.path)));
+    const bytes = new Uint8Array(await fs2.readFile(join6(outputAbs, file.path)));
     manifest.push({ path: file.path, size: file.size, contentHash: await sha256Hex(bytes) });
   }
   return manifest;
@@ -2400,7 +2589,7 @@ async function uploadAll(ctx, targets, files, outputAbs) {
         `No local file matches upload target "${target.path}"; aborting upload.`
       );
     }
-    const bytes = new Uint8Array(await fs2.readFile(join5(outputAbs, match.path)));
+    const bytes = new Uint8Array(await fs2.readFile(join6(outputAbs, match.path)));
     if (bytes.byteLength !== match.size) {
       throw new SakupaError(
         "validation_failed",
@@ -2443,21 +2632,6 @@ ${block}`, checklist: toDnsChecklist(diag.checks) };
     };
   }
 }
-function projectRootAbove(projectDir) {
-  if (existsSync3(join5(projectDir, "package.json"))) return null;
-  const packageRoot = findAncestor(projectDir, (dir) => existsSync3(join5(dir, "package.json")), 4);
-  if (packageRoot) {
-    return {
-      projectRoot: packageRoot,
-      outputDir: relative2(packageRoot, projectDir).split(sep3).join("/")
-    };
-  }
-  return null;
-}
-function findNeighborBinding(projectDir) {
-  const bound = (dir) => loadSiteFile(dir).kind !== "absent";
-  return findAncestor(projectDir, bound, 3);
-}
 function freeSiteCreationBarrier(apiBaseUrl) {
   const recent = listRecentCreations(Date.now(), apiBaseUrl);
   if (recent.length < FREE_ACTIVE_SITES_PER_IP) return null;
@@ -2468,7 +2642,7 @@ function freeSiteCreationBarrier(apiBaseUrl) {
 
 ` + recent.map((r) => `- ${r.url} (project: ${r.projectDir}, created: ${r.createdAt})`).join("\n") + `
 
-How a slot frees up: (1) delete one of the sites above \u2014 run delete with that site's projectDir; its slot frees immediately; (2) every record expires on its own 24 hours after creation; (3) a site that upgrades to a paid plan stops counting the next time any tool sees it. Deleting a project's .sakupa folder does NOT free a slot: this registry lives in the home directory and the server still counts the live site.
+How a slot frees up: (1) delete one of the sites above \u2014 run delete with that site opened as the AI tool's current project; its slot frees immediately; (2) every record expires on its own 24 hours after creation; (3) a site that upgrades to a paid plan stops counting the next time any tool sees it. Deleting a project's .sakupa folder does NOT free a slot: this registry lives in the home directory and the server still counts the live site.
 
 If this list is stale (sites deleted or subscribed from another machine), remove the local registry file at ${registryPath} and retry \u2014 that only skips this local precheck; the server still enforces the same per-IP limit and is the final authority.`,
     { recentCreations: recent, limit: FREE_ACTIVE_SITES_PER_IP, registryPath },
@@ -2484,13 +2658,12 @@ function registerTools(server, baseCtx) {
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
       inputSchema: {
-        projectDir: projectDirInput,
-        outputDir: z3.string().optional().describe("Output directory relative to the project root (overrides detection).")
+        outputDir: z2.string().optional().describe("Output directory relative to the project root (overrides detection).")
       }
     },
     async (args) => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
+        const ctx = withProjectDir(baseCtx);
         const analysis = await analyzeProject(ctx.projectDir, {
           ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {}
         });
@@ -2508,35 +2681,54 @@ Next action: ${analysis.suggestedNextAction}`,
   server.registerTool(
     "deploy",
     {
-      description: `Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid ${FREE_SITE_TTL_HOURS}h, public URL like https://${previewHostPattern}) and stores the management credential in .sakupa/site.json. Later runs update the existing site (free sites also refresh their validity; subscribed sites are permanent). Runs analyze first and refuses to upload source projects, secrets, .env files, archives, media or server code. projectDir is ALWAYS the project root where .sakupa belongs; outputDir is a separate REQUIRED relative path supplied from the current project inspection ("." when the root itself is published). NEVER pass the build/output folder as projectDir. Never uploads anything when analysis says the project is not deployable.`,
+      description: `Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid ${FREE_SITE_TTL_HOURS}h, public URL like https://${previewHostPattern}) and stores the management credential in .sakupa/site.json. Later runs update the existing site (free sites also refresh their validity; subscribed sites are permanent). Runs analyze first and refuses to upload source projects, secrets, .env files, archives, media or server code. The MCP process is locked to the current directory initialized by \`npx -y @sakupa/mcp@latest init\`; no tool argument can change that root. outputDir is a separate REQUIRED relative path supplied from the current project inspection. Never uploads anything when analysis says the project is not deployable.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
-        projectDir: projectDirInput,
-        outputDir: z3.string().min(1).describe(
-          'REQUIRED: exact publish directory relative to projectDir, supplied by the AI after inspecting this project (for example ".", "dist", "html", or any custom build directory). NEVER put this path in projectDir; .sakupa belongs at projectDir.'
+        outputDir: z2.string().min(1).describe(
+          'REQUIRED: exact publish directory relative to the initialized project root, supplied by the AI after inspecting this project (for example ".", "dist", "html", or any custom build directory). Sakupa applies it only inside the cwd-locked project.'
         ),
-        spaFallback: z3.boolean().optional().describe(
+        outputDirChangeConfirmed: z2.boolean().optional().describe(
+          "Required only when changing the previously successful publish directory. Confirm only after showing the old and new directories to the user."
+        ),
+        spaFallback: z2.boolean().optional().describe(
           "Override automatic SPA-fallback detection (single index.html + JS auto-enables rewriting unknown paths to index.html; multiple HTML pages auto-disable it). Pass only to force the behavior against the detected structure."
         ),
-        publicConfirmed: z3.boolean().optional().describe(
+        publicConfirmed: z2.boolean().optional().describe(
           "Required only for the first deployment: user explicitly confirmed creation of a public 24-hour URL."
         ),
-        subprojectConfirmed: z3.boolean().optional().describe(
-          "Only when creating a NEW site in a subfolder of a package.json project: the user explicitly confirmed this subfolder is an INDEPENDENT site, not the project's build output."
+        subprojectConfirmed: z2.boolean().optional().describe(
+          "Deprecated compatibility field. Project independence is established only by `sakupa-mcp init`, never inferred from package.json or folder names."
         ),
-        lang: z3.string().optional().describe("Site language override (en | ja | zh-CN); defaults to the html lang.")
+        lang: z2.string().optional().describe("Site language override (en | ja | zh-CN); defaults to the html lang.")
       }
     },
     async (args) => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
+        const ctx = withProjectDir(baseCtx);
         const analysis = await analyzeProject(ctx.projectDir, { outputDir: args.outputDir });
         if (!analysis.deployable || !analysis.files) {
           return notDeployableResult(analysis);
         }
+        const effectiveOutputDir = analysis.recommendedOutputDir ?? ".";
+        const recordedOutputDir = ctx.projectMarker?.outputDir;
+        if (recordedOutputDir !== void 0 && resolve4(ctx.projectDir, recordedOutputDir) !== resolve4(ctx.projectDir, effectiveOutputDir) && args.outputDirChangeConfirmed !== true) {
+          return structuredToolResult({
+            schemaVersion: 1,
+            outcome: "waiting_user",
+            resultCode: "publish_directory_change_confirmation_required",
+            summary: `This initialized project last published from "${recordedOutputDir}", but this request selected "${effectiveOutputDir}". Nothing was uploaded and the site was not changed. Show both paths to the user; only after explicit confirmation call deploy again with outputDirChangeConfirmed: true.`,
+            data: {
+              projectDir: ctx.projectDir,
+              previousOutputDir: recordedOutputDir,
+              requestedOutputDir: effectiveOutputDir,
+              confirmationField: "outputDirChangeConfirmed"
+            },
+            nextActions: [{ tool: "deploy", allowed: true, reasonCode: "explicit_confirmation" }]
+          });
+        }
         const files = analysis.files;
-        const outputAbs = resolve4(ctx.projectDir, analysis.recommendedOutputDir ?? ".");
+        const outputAbs = resolve4(ctx.projectDir, effectiveOutputDir);
         const manifest = await buildHashedManifest(files, outputAbs);
         const siteFileState = loadSiteFile(ctx.projectDir);
         if (siteFileState.kind === "corrupted") {
@@ -2551,46 +2743,31 @@ Next action: ${analysis.suggestedNextAction}`,
         }
         let existing = siteFileState.kind === "ok" ? siteFileState.file : null;
         let credentialRelocatedFrom = null;
-        if (!existing && analysis.recommendedOutputDir !== ".") {
+        if (!existing && effectiveOutputDir !== ".") {
+          const outputProjectMarker = loadProjectMarker(outputAbs);
+          if (outputProjectMarker.kind !== "absent") {
+            return text(
+              "publish_directory_is_independent_project",
+              outputProjectMarker.kind === "corrupted" ? `The selected publish directory ${outputAbs} contains a damaged Sakupa project marker: ${outputProjectMarker.problem}. Nothing was deployed.` : `The selected publish directory ${outputAbs} is itself an explicitly initialized Sakupa project. Refusing to move or reuse its credential from ${ctx.projectDir}. Run deploy from that independent project instead, or choose a publish directory that is not another Sakupa project.`,
+              { projectRoot: ctx.projectDir, outputDir: effectiveOutputDir },
+              "blocked"
+            );
+          }
           const outputSiteState = loadSiteFile(outputAbs);
           if (outputSiteState.kind === "corrupted") {
             return text(
               "output_site_file_corrupted",
-              `A misplaced .sakupa/site.json exists in output directory ${outputAbs}, but it is damaged: ${outputSiteState.problem}. Repair that file before retrying with projectDir: ${ctx.projectDir}. Nothing was deployed and no site was created.`,
+              `A misplaced .sakupa/site.json exists in output directory ${outputAbs}, but it is damaged: ${outputSiteState.problem}. Repair that file before retrying with the MCP still opened at ${ctx.projectDir}. Nothing was deployed and no site was created.`,
               { projectRoot: ctx.projectDir, outputDir: analysis.recommendedOutputDir },
               "blocked"
             );
           }
           if (outputSiteState.kind === "ok") {
-            writeSiteFile(ctx.projectDir, outputSiteState.file);
-            deleteSiteFile(outputAbs);
             existing = outputSiteState.file;
             credentialRelocatedFrom = outputAbs;
           }
         }
         if (!existing) {
-          const rootHint = args.subprojectConfirmed === true ? null : projectRootAbove(ctx.projectDir);
-          if (rootHint) {
-            return text(
-              "not_project_root",
-              `${ctx.projectDir} is a SUBFOLDER of a package.json project, and .sakupa must live at the project ROOT. Re-run deploy with projectDir: ${rootHint.projectRoot} and outputDir: ${rootHint.outputDir}. Only if the user explicitly says this subfolder is an INDEPENDENT site (e.g. a docs/ site inside a repo), re-run with subprojectConfirmed: true. Nothing was deployed and no site was created.`,
-              {
-                projectRoot: rootHint.projectRoot,
-                outputDir: rootHint.outputDir,
-                confirmationField: "subprojectConfirmed"
-              },
-              "blocked"
-            );
-          }
-          const neighbor = findNeighborBinding(ctx.projectDir);
-          if (neighbor) {
-            return text(
-              "neighbor_binding_found",
-              `No .sakupa binding in ${ctx.projectDir}, but one EXISTS at ${neighbor} \u2014 this looks like the same project addressed at a different directory level. To update that existing site, re-run deploy with projectDir: ${neighbor}. Only if the user explicitly wants a SEPARATE new site, move this deploy to a directory outside that project. Nothing was deployed and no site was created.`,
-              { neighborProjectDir: neighbor },
-              "blocked"
-            );
-          }
           const barrier = freeSiteCreationBarrier(ctx.apiBaseUrl);
           if (barrier) return barrier;
           if (args.publicConfirmed !== true) {
@@ -2624,6 +2801,7 @@ Next action: ${analysis.suggestedNextAction}`,
             createdAt,
             apiBaseUrl: ctx.apiBaseUrl
           });
+          updateProjectOutputDir(ctx.projectDir, effectiveOutputDir);
           recordCreation({
             siteId: created.siteId,
             projectDir: ctx.projectDir,
@@ -2698,6 +2876,8 @@ ${JSON.stringify(finalized2.warnings, null, 2)}` : ""),
         }
         const { uploaded, finalized } = update;
         writeSiteFile(ctx.projectDir, { ...existing, url: finalized.url });
+        if (credentialRelocatedFrom !== null) deleteSiteFile(credentialRelocatedFrom);
+        updateProjectOutputDir(ctx.projectDir, effectiveOutputDir);
         noteSiteMode(existing.siteId, finalized.mode);
         return text(
           "site_updated",
@@ -2736,11 +2916,11 @@ ${JSON.stringify(finalized.warnings, null, 2)}` : ""),
       description: "Refresh the validity of the free temporary site WITHOUT uploading content. Uses the local credential in .sakupa/site.json. Subscribed sites are permanent and need no refresh.",
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
-      inputSchema: { projectDir: projectDirInput }
+      inputSchema: {}
     },
-    async (args) => {
+    async () => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
+        const ctx = withProjectDir(baseCtx);
         const site = requireSiteFile(ctx);
         const res = await ctx.client.refreshSite(site.siteId, site.credential);
         return text(
@@ -2760,11 +2940,11 @@ NO content was uploaded or changed by this call \u2014 to publish new or edited
       description: "Show the current status of this project's Sakupa site: URL, mode (free/paid), expiry, custom domains, size, last deployment and warnings. For a paid site this tool also automatically returns the complete authoritative billing snapshot; users never need to know or name a separate billing tool to get accurate subscription information.",
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true },
-      inputSchema: { projectDir: projectDirInput }
+      inputSchema: {}
     },
-    async (args) => {
+    async () => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
+        const ctx = withProjectDir(baseCtx);
         const site = requireSiteFile(ctx);
         const res = await ctx.client.getSiteStatus(site.siteId, site.credential);
         noteSiteMode(res.siteId, res.mode);
@@ -2792,7 +2972,6 @@ NO content was uploaded or changed by this call \u2014 to publish new or edited
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
       inputSchema: {
-        projectDir: projectDirInput,
         plan: planEnum.describe(
           "Monthly plan: water (very light personal pages), personal (personal brand / small shop), share (small-business site), business (steadier traffic, more headroom)."
         )
@@ -2800,13 +2979,13 @@ NO content was uploaded or changed by this call \u2014 to publish new or edited
     },
     async (args) => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
+        const ctx = withProjectDir(baseCtx);
         const site = requireSiteFile(ctx);
         const res = await ctx.client.createPlanCheckout(
           {
             siteId: site.siteId,
             plan: args.plan,
-            idempotencyKey: randomUUID()
+            idempotencyKey: randomUUID2()
           },
           site.credential
         );
@@ -2839,17 +3018,16 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
-        projectDir: projectDirInput,
-        action: z3.enum(["start", "status"]),
-        hostname: z3.string().optional().describe("Required for start."),
-        verificationId: z3.string().optional().describe(
+        action: z2.enum(["start", "status"]),
+        hostname: z2.string().optional().describe("Required for start."),
+        verificationId: z2.string().optional().describe(
           "Optional for status: when omitted, the server finds this site's latest binding verification \u2014 a NEW session can resume without it."
         )
       }
     },
     async (args) => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
+        const ctx = withProjectDir(baseCtx);
         const site = requireSiteFile(ctx);
         if (args.action === "status") {
           const res2 = args.verificationId ? await ctx.client.checkVerification(args.verificationId, site.credential) : await ctx.client.checkVerification("latest", site.credential, site.siteId);
@@ -2954,11 +3132,11 @@ When the user says the TXT is set, run bind "status". It verifies ownership and
       description: "Return the sole authoritative source for this site's hosting subscription: current plan, next renewal plan or cancellation, effective time, payment state, current paid entitlement, reconciled usage, estimated usage tier, bound custom domains and risks. Owner-only (uses the credential in .sakupa/site.json).",
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true },
-      inputSchema: { projectDir: projectDirInput }
+      inputSchema: {}
     },
-    async (args) => {
+    async () => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
+        const ctx = withProjectDir(baseCtx);
         const site = requireSiteFile(ctx);
         const res = await ctx.client.getBillingStatus(site.siteId, site.credential);
         noteSiteMode(res.siteId, res.mode);
@@ -2996,14 +3174,13 @@ Full status:`, res);
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
       inputSchema: {
-        projectDir: projectDirInput,
-        scope: z3.enum(["site", "public_recovery"])
+        scope: z2.enum(["site", "public_recovery"])
       }
     },
     async (args) => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
         if (args.scope === "site") {
+          const ctx = withProjectDir(baseCtx);
           const site = requireSiteFile(ctx);
           const res2 = await ctx.client.createBillingPortal(site.siteId, site.credential);
           return structuredToolResult({
@@ -3021,7 +3198,7 @@ Full status:`, res);
             nextActions: [{ tool: "billing", allowed: true }]
           });
         }
-        const res = await ctx.client.getPublicBillingPortal();
+        const res = await baseCtx.client.getPublicBillingPortal();
         return structuredToolResult({
           schemaVersion: 1,
           outcome: "waiting_user",
@@ -3049,21 +3226,28 @@ Full status:`, res);
   server.registerTool(
     "recover",
     {
-      description: "Recover management control of a subscribed site WITH A BOUND CUSTOM DOMAIN after losing the local project, by proving DNS control of the apex domain. Sites without a bound domain are identified solely by their local credential and cannot be recovered. By default, completing recovery REVOKES all previous local credentials. Recovery is resumable: start stores local pending state; complete installs and writes the new .sakupa/site.json credential BEFORE requesting content; download uses that credential to reissue an archive and safely extract it into html without repeating DNS.",
+      description: "Recover management control of a subscribed site WITH A BOUND CUSTOM DOMAIN after losing the local project, by proving DNS control of the apex domain. Sites without a bound domain are identified solely by their local credential and cannot be recovered. By default, completing recovery REVOKES all previous local credentials. Recovery is resumable: start stores local pending state; complete installs and writes the new .sakupa/site.json credential BEFORE requesting content; download uses that credential to reissue an archive and safely extract it into the explicitly selected outputDir without repeating DNS.",
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
-        projectDir: projectDirInput,
-        action: z3.enum(["start", "status", "complete", "download"]),
-        hostname: z3.string().optional().describe("Required for start."),
-        verificationId: z3.string().optional().describe("For status or complete; inferred from local recovery state when omitted."),
-        outputDir: z3.string().optional().describe("Relative extraction directory for complete/download (default: html)."),
-        preserveExistingCredentials: z3.boolean().optional().describe("Explicitly keep old local credentials working (default: revoke them all).")
+        action: z2.enum(["start", "status", "complete", "download"]),
+        hostname: z2.string().optional().describe("Required for start."),
+        verificationId: z2.string().optional().describe("For status or complete; inferred from local recovery state when omitted."),
+        outputDir: z2.string().optional().describe(
+          "REQUIRED for complete/download: exact extraction directory relative to the initialized project root. Inspect the current project; Sakupa never guesses a name."
+        ),
+        preserveExistingCredentials: z2.boolean().optional().describe("Explicitly keep old local credentials working (default: revoke them all).")
       }
     },
     async (args) => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
+        const ctx = withProjectDir(baseCtx);
+        if ((args.action === "complete" || args.action === "download") && args.outputDir === void 0) {
+          throw new LocalGuidanceError(
+            "invalid_request",
+            "recover requires outputDir for complete/download. Inspect the current project and pass the exact extraction directory relative to the initialized Sakupa root; the server never defaults to html, dist, build, or any other name."
+          );
+        }
         const localSite = loadSiteFile(ctx.projectDir);
         const localCredentialIsActive = async () => {
           if (localSite.kind !== "ok") return false;
@@ -3076,12 +3260,18 @@ Full status:`, res);
           }
         };
         const download = async () => {
+          if (args.outputDir === void 0) {
+            throw new LocalGuidanceError(
+              "invalid_request",
+              "recover download requires an explicit outputDir."
+            );
+          }
           const site = requireSiteFile(ctx);
           const archive = await ctx.client.getSiteArchive(site.siteId, site.credential);
           const bytes = await ctx.client.downloadArchive(archive.archiveUrl);
           const extracted = await extractRecoveryArchive({
             projectDir: ctx.projectDir,
-            ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {},
+            outputDir: args.outputDir,
             archive: bytes,
             expectedBytes: archive.totalBytes,
             expectedFiles: archive.fileCount
@@ -3124,9 +3314,8 @@ No DNS verification was started or repeated.`,
                 {
                   tool: "recover",
                   arguments: {
-                    projectDir: ctx.projectDir,
                     action: "download",
-                    outputDir: args.outputDir ?? "html"
+                    ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {}
                   },
                   allowed: true
                 }
@@ -3151,7 +3340,6 @@ No DNS verification was started or repeated.`,
                 {
                   tool: "recover",
                   arguments: {
-                    projectDir: ctx.projectDir,
                     action: "status",
                     verificationId: pending2.verificationId
                   },
@@ -3224,9 +3412,8 @@ After the DNS record resolves, re-run recover with verificationId: "${res2.verif
               {
                 tool: "recover",
                 arguments: {
-                  projectDir: ctx.projectDir,
                   action: "download",
-                  outputDir: args.outputDir ?? "html"
+                  ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {}
                 },
                 allowed: true
               }
@@ -3259,10 +3446,9 @@ After the DNS record resolves, re-run recover with verificationId: "${res2.verif
               {
                 tool: "recover",
                 arguments: {
-                  projectDir: ctx.projectDir,
                   action: "complete",
                   verificationId,
-                  outputDir: args.outputDir ?? "html"
+                  ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {}
                 },
                 allowed: res2.readyToComplete,
                 ...res2.readyToComplete ? {} : { reasonCode: res2.status }
@@ -3336,9 +3522,8 @@ Files: ${extracted.fileCount}; bytes: ${extracted.totalBytes}
               {
                 tool: "recover",
                 arguments: {
-                  projectDir: ctx.projectDir,
                   action: "download",
-                  outputDir: args.outputDir ?? "html"
+                  ...args.outputDir !== void 0 ? { outputDir: args.outputDir } : {}
                 },
                 allowed: true
               }
@@ -3357,16 +3542,15 @@ Files: ${extracted.fileCount}; bytes: ${extracted.totalBytes}
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
       inputSchema: {
-        projectDir: projectDirInput,
         category: ticketCategoryEnum,
-        subject: z3.string().describe("Short subject line."),
-        description: z3.string().describe("Problem description (no secrets, no card data)."),
-        contactEmail: z3.string().optional().describe("Optional contact email for follow-up.")
+        subject: z2.string().describe("Short subject line."),
+        description: z2.string().describe("Problem description (no secrets, no card data)."),
+        contactEmail: z2.string().optional().describe("Optional contact email for follow-up.")
       }
     },
     async (args) => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
+        const ctx = withProjectDir(baseCtx);
         const site = requireSiteFile(ctx);
         const res = await ctx.client.createTicket(site.credential, {
           siteId: site.siteId,
@@ -3392,26 +3576,25 @@ Files: ${extracted.fileCount}; bytes: ${extracted.totalBytes}
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
       inputSchema: {
-        projectDir: projectDirInput,
-        toolName: z3.string().describe('The Sakupa tool that failed, e.g. "deploy".'),
-        errorCode: z3.string().optional(),
-        errorMessage: z3.string().optional().describe("Sanitized error message (no secrets)."),
-        requestId: z3.string().optional(),
-        deploymentId: z3.string().optional(),
+        toolName: z2.string().describe('The Sakupa tool that failed, e.g. "deploy".'),
+        errorCode: z2.string().optional(),
+        errorMessage: z2.string().optional().describe("Sanitized error message (no secrets)."),
+        requestId: z2.string().optional(),
+        deploymentId: z2.string().optional(),
         severity: severityEnum.optional(),
-        description: z3.string().optional().describe("What happened, in the user's words (no secrets)."),
-        agentContext: z3.string().optional().describe(
+        description: z2.string().optional().describe("What happened, in the user's words (no secrets)."),
+        agentContext: z2.string().optional().describe(
           "YOUR OWN factual account of the session as the AI: which tools you called, what they returned, expected vs actual. Write it yourself from your observations \u2014 never ask the user to compose it, and do not read it back to them; it travels alongside the user's description as a second witness. No secrets, no file contents."
         ),
-        contactEmail: z3.string().optional().describe(
+        contactEmail: z2.string().optional().describe(
           "OPTIONAL. Before submitting, ask the user ONCE whether they want to leave a contact for follow-up. Omit entirely if they decline \u2014 never require it."
         ),
-        confirmSubmit: z3.boolean().optional().describe("User reviewed the report payload and approved submission.")
+        confirmSubmit: z2.boolean().optional().describe("User reviewed the report payload and approved submission.")
       }
     },
     async (args) => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
+        const ctx = withProjectDir(baseCtx);
         const siteState = loadSiteFile(ctx.projectDir);
         const site = siteState.kind === "ok" ? siteState.file : null;
         const diagnostics = {
@@ -3458,22 +3641,22 @@ Summary: ${res.sanitizedSummary}`,
 }
 
 // src/tools/lifecycle.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { z as z4 } from "zod";
-var deleteConfirmation = z4.object({
-  siteId: z4.string().min(1),
-  expectedSiteUpdatedAt: z4.string().datetime(),
-  expectedStatus: z4.enum(["active", "expired", "deleted"]),
-  expectedMode: z4.enum(["free", "paid"]),
-  expectedServingMode: z4.enum(["normal", "over_limit_notice", "risk_notice", "stopped"]),
-  expectedShortId: z4.string().optional(),
-  expectedSubscriptionStatus: z4.enum(["incomplete", "active", "past_due", "canceled"]).optional(),
-  expectedPlan: z4.enum(["water", "personal", "share", "business"]).optional(),
-  expectedCancelAtPeriodEnd: z4.boolean().optional(),
-  expectedCurrentPeriodEnd: z4.string().datetime().optional(),
-  expectedLastDeploymentId: z4.string().optional(),
-  expectedBoundHostnames: z4.array(z4.string()),
-  acknowledge: z4.literal("delete_and_cancel_renewal")
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { z as z3 } from "zod";
+var deleteConfirmation = z3.object({
+  siteId: z3.string().min(1),
+  expectedSiteUpdatedAt: z3.string().datetime(),
+  expectedStatus: z3.enum(["active", "expired", "deleted"]),
+  expectedMode: z3.enum(["free", "paid"]),
+  expectedServingMode: z3.enum(["normal", "over_limit_notice", "risk_notice", "stopped"]),
+  expectedShortId: z3.string().optional(),
+  expectedSubscriptionStatus: z3.enum(["incomplete", "active", "past_due", "canceled"]).optional(),
+  expectedPlan: z3.enum(["water", "personal", "share", "business"]).optional(),
+  expectedCancelAtPeriodEnd: z3.boolean().optional(),
+  expectedCurrentPeriodEnd: z3.string().datetime().optional(),
+  expectedLastDeploymentId: z3.string().optional(),
+  expectedBoundHostnames: z3.array(z3.string()),
+  acknowledge: z3.literal("delete_and_cancel_renewal")
 });
 function registerLifecycleTools(server, baseCtx) {
   server.registerTool(
@@ -3481,9 +3664,8 @@ function registerLifecycleTools(server, baseCtx) {
     {
       description: "Preview or execute deletion of this Sakupa site. Execution requires an exact server-validated confirmation bound to the current site state. Paid sites must first cancel renewal through portal and return to free mode. For a temporary pause, publish a pause notice as index.html with deploy instead of deleting the site.",
       inputSchema: {
-        projectDir: projectDirInput,
-        action: z4.enum(["preview", "confirm"]),
-        operationId: z4.string().min(1).optional(),
+        action: z3.enum(["preview", "confirm"]),
+        operationId: z3.string().min(1).optional(),
         confirmation: deleteConfirmation.optional()
       },
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
@@ -3491,9 +3673,9 @@ function registerLifecycleTools(server, baseCtx) {
     },
     async (args) => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
+        const ctx = withProjectDir(baseCtx);
         const site = requireSiteFile(ctx);
-        const operationId = args.operationId ?? randomUUID2();
+        const operationId = args.operationId ?? randomUUID3();
         if (args.action === "preview") {
           const preview = await ctx.client.previewDeleteSite(site.siteId, site.credential, {
             operationId
@@ -3562,20 +3744,19 @@ function registerLifecycleTools(server, baseCtx) {
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/tools/billing.ts
-import { z as z5 } from "zod";
+import { z as z4 } from "zod";
 function registerBillingTools(server, baseCtx) {
   server.registerTool(
     "plans",
     {
       description: "Return the authoritative Sakupa monthly plan catalog, exact limits, prices, catalog version and plan-change billing rules. This is read-only and does not require a site.",
-      inputSchema: { projectDir: projectDirInput },
+      inputSchema: {},
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true }
     },
-    async (args) => {
+    async () => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
-        const catalog = await ctx.client.getBillingPlanCatalog();
+        const catalog = await baseCtx.client.getBillingPlanCatalog();
         return structuredToolResult({
           schemaVersion: 1,
           outcome: "completed",
@@ -3594,15 +3775,14 @@ function registerBillingTools(server, baseCtx) {
     {
       description: "Create one Stripe-hosted subscription-management link. The user chooses the plan or period-end cancellation on Stripe; Sakupa never infers intent from the conversation. Creating the link does not change billing.",
       inputSchema: {
-        projectDir: projectDirInput,
-        operationId: z5.string().min(1)
+        operationId: z4.string().min(1)
       },
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true }
     },
     async (args) => {
       try {
-        const ctx = withProjectDir(baseCtx, args.projectDir);
+        const ctx = withProjectDir(baseCtx);
         const site = requireSiteFile(ctx);
         const result = await ctx.client.changeSubscriptionPlan(site.credential, {
           siteId: site.siteId,
@@ -3663,18 +3843,22 @@ Workflow:
 5. support (subscribed sites) opens a support ticket; report sends a
    sanitized diagnostic report after the user explicitly confirms it.
 
-Project directory contract: ONE directory = ONE site (its .sakupa/site.json holds the
-binding). projectDir is REQUIRED on EVERY tool call \u2014 always pass the absolute path of
-the user's PROJECT ROOT, the SAME directory every time for the same project: the folder
-the user opened (for framework projects, where package.json lives \u2014 never the dist/out
-build folder). For deploy, ALWAYS pass outputDir separately as the exact path RELATIVE to
-projectDir (use "." when publishing the root); outputDir is required and may have ANY name,
-so inspect the current project and never infer it from a conventional folder name. The server
-NEVER guesses either directory: only you can see the user's actual workspace and build output.
+Project directory contract: before the first deploy or a new recovery, initialize the intended
+project once by running "npx -y @sakupa/mcp@latest init" with NO path argument from the AI
+tool's current project directory. This immediately creates the non-secret .sakupa/project.json
+there. ONE MCP process = ONE cwd-locked project = ONE site. Site tools do not accept projectDir
+and cannot select another root; plans and public_recovery portal remain project-independent.
+Sakupa stores .sakupa/site.json and recovery state only in the locked directory; it never uses
+package.json, .git, framework names or output-directory names to guess. For deploy, ALWAYS pass
+outputDir separately as the exact path RELATIVE to the locked directory (use "." when publishing
+the root); outputDir is
+required and may have ANY name, so inspect the current project. If it differs from the last
+successful publish directory, show the old and new paths and obtain explicit confirmation
+before retrying with outputDirChangeConfirmed: true.
 After every deploy, TELL the user which environment it went to (deploy results carry an
 Explicit Environment line: TEST vs PRODUCTION). analyze, deploy, status,
 refresh and delete echo
-the directory they acted on \u2014 verify it matches the user's active project.
+the cwd-locked directory they acted on.
 
 When the same operation fails twice in a row, or the user is clearly stuck or
 frustrated, proactively offer report: it files the problem into Sakupa's ticket and
@@ -3712,7 +3896,11 @@ function createSakupaMcpServer(opts) {
     { name: "sakupa", version: MCP_VERSION },
     { instructions: instructionsFor(previewHostPatternFor(opts.apiBaseUrl)) }
   );
-  const ctx = { client, apiBaseUrl: opts.apiBaseUrl };
+  const ctx = {
+    client,
+    apiBaseUrl: opts.apiBaseUrl,
+    projectDir: canonicalProjectDirectory(opts.projectDir ?? process.cwd())
+  };
   registerTools(server, ctx);
   registerBillingTools(server, ctx);
   registerLifecycleTools(server, ctx);