@systemdox/mcp-server 0.1.45 → 0.1.46

package/README.md

@@ -140,6 +140,52 @@ npx -y @systemdox/mcp-server install-skill <name> [--version n] [--target dir] [
 Exit codes: `0` installed, `1` usage / no key / API error, `2` refused because
 files there were edited.
 
+### Team setup (ADR-217)
+
+Your workspace's Claude Code setup (hooks, MCP servers, agents, commands, the
+skills your team chose, and one team `CLAUDE.md`) is published to SystemDox and
+reaches every member's computer as one plugin, `<workspace>-setup`.
+
+- **`publish_setup_part`** (both servers) publishes one part: `hooks`
+  (`hooks/hooks.json` and the `scripts/` it calls), `mcp` (`.mcp.json`),
+  `agents` (`agents/*.md`), `commands` (`commands/*.md`) or `instructions`
+  (`CLAUDE.md`). On your own computer pass `directory`: only the files the part
+  accepts are read, and a link, a binary file or a file over the limits stops it
+  before anything is sent. Every part but `instructions` makes a new plugin
+  version, which each member accepts at their next update. For `mcp`, every
+  `env` and `headers` value is replaced by a `${NAME}` reference to each
+  member's own environment variable. Publishing `hooks`, `mcp`, `agents` or
+  `commands` needs the admin role (SYD-A003 otherwise).
+- **`resolve_person`** (both servers) reads back a person a team memory names
+  by identifier (`` `con_…` (reseller, sales) ``): their label, name, phone
+  number and email address. The details are for that session only; the memory
+  keeps the identifier. It writes nothing.
+
+Claude Code runs two commands itself; you never type them:
+
+```bash
+npx -y @systemdox/mcp-server marketplace-auth
+npx -y @systemdox/mcp-server plugin-path <workspace> --version <n> --sha256 <hash>
+```
+
+- `marketplace-auth` gives Claude Code the header for your team's marketplace.
+  It gives your key only for a SystemDox team marketplace on the API's own host
+  (`SYSTEMDOX_API_URL`, https), and only for that workspace; anything else gets
+  nothing and exit `1`. No network call, nothing written.
+- `plugin-path` prints the folder of your team's plugin version. A version
+  already on your computer is printed with no network call. Otherwise it
+  downloads the zip, refuses it unless its SHA-256 is the one Claude Code
+  named, refuses an entry that is absolute, contains `..`, is a link or takes
+  the plugin past 20 MB, and only then unpacks it into
+  `~/.claude/systemdox/<workspace>/plugin/<n>/`. Exit codes: `0` the folder is
+  printed, `1` usage / no key / API error, `2` the SHA-256 differs or an entry
+  was refused.
+
+Both read your key from `SYSTEMDOX_API_KEY`, then from
+`~/.claude/systemdox/credentials.json` for the workspace (readable by you
+alone). A key is never written into a settings file, a plugin entry or a
+command line.
+
 ### `get_context`
 
 The aggregator. It ranks checks, specs and docs against the task, then