@systemdox/mcp-server 0.1.45 → 0.1.46

package/dist/cli.js

@@ -51,6 +51,146 @@ var init_config = __esm({
   }
 });
 
+// src/lib/team-setup-files.ts
+import { execFile } from "child_process";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import { homedir, userInfo } from "os";
+import { dirname, join } from "path";
+import { promisify } from "util";
+function isWorkspace(value) {
+  return typeof value === "string" && value.length <= 64 && SLUG_RE.test(value);
+}
+function homeDir() {
+  return homedir();
+}
+function systemdoxDir() {
+  return join(homeDir(), ".claude", "systemdox");
+}
+function credentialsPath() {
+  return join(systemdoxDir(), "credentials.json");
+}
+function workspaceDir(workspace) {
+  if (!isWorkspace(workspace)) throw new Error(`${JSON.stringify(workspace)} is not a workspace name`);
+  return join(systemdoxDir(), workspace);
+}
+function statePath(workspace) {
+  return join(workspaceDir(workspace), "state.json");
+}
+function pluginRoot(workspace) {
+  return join(workspaceDir(workspace), "plugin");
+}
+function pluginDir(workspace, version) {
+  return join(pluginRoot(workspace), String(version));
+}
+async function readJson(path, empty) {
+  let text3;
+  try {
+    text3 = await readFile(path, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return empty;
+    throw e;
+  }
+  try {
+    return JSON.parse(text3);
+  } catch {
+    throw new Error(`${path} is not valid JSON: fix or remove it, then run this again`);
+  }
+}
+async function writeJsonAtomically(path, value, mode) {
+  await mkdir(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  await writeFile(tmp, JSON.stringify(value, null, 2) + "\n", mode === void 0 ? "utf8" : { encoding: "utf8", mode });
+  await rename(tmp, path);
+}
+async function readCredentials() {
+  return readJson(credentialsPath(), {});
+}
+async function apiKeyFor(workspace, env = process.env) {
+  if (env.SYSTEMDOX_API_KEY) return env.SYSTEMDOX_API_KEY;
+  const entry = (await readCredentials())[workspace];
+  return typeof entry?.apiKey === "string" && entry.apiKey ? entry.apiKey : void 0;
+}
+function apiUrlFrom(env = process.env) {
+  return requireHttpsApiUrl(env.SYSTEMDOX_API_URL || API_URL_DEFAULT);
+}
+async function readState(workspace) {
+  return readJson(statePath(workspace), {});
+}
+async function writeState(workspace, state) {
+  await writeJsonAtomically(statePath(workspace), state);
+}
+async function updateState(workspace, change) {
+  const state = await readState(workspace);
+  change(state);
+  await writeState(workspace, state);
+  return state;
+}
+async function removeFolder(path) {
+  await rm(path, { recursive: true, force: true });
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function marketplaceWorkspace(marketplaceUrl, apiUrl) {
+  let url;
+  let api;
+  try {
+    url = new URL(marketplaceUrl);
+    api = new URL(requireHttpsApiUrl(apiUrl));
+  } catch {
+    return void 0;
+  }
+  if (url.protocol !== "https:" || url.origin !== api.origin || url.username || url.password) return void 0;
+  const base = api.pathname.replace(/\/+$/, "");
+  const m = new RegExp(`^${escapeRegExp(base)}/v1/team-setup/([^/]+)/marketplace\\.json$`).exec(url.pathname);
+  return m && isWorkspace(m[1]) ? m[1] : void 0;
+}
+async function runMarketplaceAuth(io, env = process.env) {
+  const url = env.CLAUDE_CODE_MARKETPLACE_URL;
+  if (!url) {
+    io.err("marketplace-auth: CLAUDE_CODE_MARKETPLACE_URL is not set; Claude Code sets it when it fetches a marketplace.");
+    return 1;
+  }
+  let apiUrl;
+  try {
+    apiUrl = apiUrlFrom(env);
+  } catch (e) {
+    io.err(`marketplace-auth: ${e.message}`);
+    return 1;
+  }
+  const workspace = marketplaceWorkspace(url, apiUrl);
+  if (!workspace) {
+    io.err(
+      `marketplace-auth: refusing to give a SystemDox key for ${url}: it is not a SystemDox team marketplace on ${apiUrl}`
+    );
+    return 1;
+  }
+  let key;
+  try {
+    key = await apiKeyFor(workspace, env);
+  } catch (e) {
+    io.err(`marketplace-auth: ${e.message}`);
+    return 1;
+  }
+  if (!key) {
+    io.err(
+      `marketplace-auth: no SystemDox key for ${workspace}. Set SYSTEMDOX_API_KEY, or run npx -y @systemdox/mcp-server setup.`
+    );
+    return 1;
+  }
+  io.out(JSON.stringify({ Authorization: `Bearer ${key}` }));
+  return 0;
+}
+var SLUG_RE, run;
+var init_team_setup_files = __esm({
+  "src/lib/team-setup-files.ts"() {
+    "use strict";
+    init_config();
+    SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+    run = promisify(execFile);
+  }
+});
+
 // src/lib/cache.ts
 var ResponseCache;
 var init_cache = __esm({
@@ -88,11 +228,33 @@ var init_cache = __esm({
 });
 
 // src/lib/api-client.ts
-var SystemDoxApiClient;
+var SystemDoxApiError, TEAM_SETUP, seg, SystemDoxApiClient;
 var init_api_client = __esm({
   "src/lib/api-client.ts"() {
     "use strict";
     init_cache();
+    SystemDoxApiError = class extends Error {
+      constructor(status, text3) {
+        super(`SystemDox API error ${status}: ${text3}`);
+        this.status = status;
+        this.text = text3;
+        let body;
+        try {
+          body = JSON.parse(text3);
+        } catch {
+          body = void 0;
+        }
+        this.body = body;
+        const code = body?.code;
+        this.code = typeof code === "string" ? code : /\b(SYD-[A-Z]\d{3})\b/.exec(text3)?.[1];
+      }
+      status;
+      text;
+      code;
+      body;
+    };
+    TEAM_SETUP = "/v1/team-setup";
+    seg = (s) => encodeURIComponent(String(s));
     SystemDoxApiClient = class {
       config;
       cache;
@@ -114,10 +276,7 @@ var init_api_client = __esm({
         const cached = this.cache.get(cacheKey);
         if (cached !== void 0) return cached;
         const res = await this.fetchRaw(path, params);
-        if (!res.ok) {
-          const body = await res.text();
-          throw new Error(`SystemDox API error ${res.status}: ${body}`);
-        }
+        if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
         const data = await res.json();
         this.cache.set(cacheKey, data);
         return data;
@@ -126,10 +285,7 @@ var init_api_client = __esm({
        * latest now, not the one cached before someone published another. */
       async getFresh(path) {
         const res = await this.fetchRaw(path);
-        if (!res.ok) {
-          const body = await res.text();
-          throw new Error(`SystemDox API error ${res.status}: ${body}`);
-        }
+        if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
         return await res.json();
       }
       async post(path, body) {
@@ -151,12 +307,101 @@ var init_api_client = __esm({
           },
           body: JSON.stringify(body)
         });
-        if (!res.ok) {
-          const text2 = await res.text();
-          throw new Error(`SystemDox API error ${res.status}: ${text2}`);
-        }
+        if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
         return await res.json();
       }
+      // ── Team setup (ADR-217, specs/changes/team-setup/openapi.yaml) ──────────
+      // One method per operationId. Every read skips the cache: setup, sync and
+      // plugin-path act on what the workspace holds now.
+      /** getOwnTeamSetup: the key's own workspace, named in `workspace`. */
+      getOwnTeamSetup() {
+        return this.getFresh(TEAM_SETUP);
+      }
+      getTeamSetup(workspace) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}`);
+      }
+      getMarketplace(workspace) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/marketplace.json`);
+      }
+      getPart(workspace, part) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/parts/${seg(part)}`);
+      }
+      publishPartVersion(workspace, part, files) {
+        return this.post(`${TEAM_SETUP}/${seg(workspace)}/parts/${seg(part)}/versions`, { files });
+      }
+      getPartVersion(workspace, part, version) {
+        return this.getFresh(
+          `${TEAM_SETUP}/${seg(workspace)}/parts/${seg(part)}/versions/${seg(version)}`
+        );
+      }
+      getSetupSkills(workspace) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/skills`);
+      }
+      setSetupSkills(workspace, skills) {
+        return this.put(`${TEAM_SETUP}/${seg(workspace)}/skills`, { skills });
+      }
+      getPlugin(workspace) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/plugin`);
+      }
+      /** getPluginZip: the zip's bytes as served, and its X-Content-SHA256
+       * header. The caller checks the BYTES against the hash it was given. */
+      async getPluginZip(workspace, version) {
+        const res = await fetch(
+          this.buildUrl(`${TEAM_SETUP}/${seg(workspace)}/plugin/versions/${seg(version)}/zip`),
+          {
+            headers: {
+              Authorization: `Bearer ${this.config.apiKey}`,
+              "X-API-Key": this.config.apiKey,
+              Accept: "application/zip"
+            }
+          }
+        );
+        if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
+        return { bytes: Buffer.from(await res.arrayBuffer()), sha256: res.headers.get("x-content-sha256") };
+      }
+      listMemoryProjects(workspace) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/memory`);
+      }
+      getMemory(workspace, project) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}`);
+      }
+      /** pushMemoryVersion: a stale base throws SystemDoxApiError with status 409,
+       * code SYD-K010 and `body.currentVersion`. */
+      pushMemoryVersion(workspace, project, body) {
+        return this.post(`${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/versions`, body);
+      }
+      getMemoryVersion(workspace, project, version) {
+        return this.getFresh(
+          `${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/versions/${seg(version)}`
+        );
+      }
+      findMissingBlobs(workspace, project, hashes) {
+        return this.post(
+          `${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/blobs/missing`,
+          { hashes }
+        );
+      }
+      uploadBlobs(workspace, project, blobs) {
+        return this.post(`${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/blobs`, { blobs });
+      }
+      readBlobs(workspace, project, hashes) {
+        return this.post(`${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/blobs/read`, { hashes });
+      }
+      listValueAnswers(workspace) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/values`);
+      }
+      lookupValues(workspace, values) {
+        return this.post(`${TEAM_SETUP}/${seg(workspace)}/values`, { values });
+      }
+      answerValues(workspace, answers) {
+        return this.put(`${TEAM_SETUP}/${seg(workspace)}/values`, { answers });
+      }
+      fileMemoryPeople(workspace, people) {
+        return this.post(`${TEAM_SETUP}/${seg(workspace)}/people`, { people });
+      }
+      resolvePerson(workspace, personId) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/people/${seg(personId)}`);
+      }
       invalidateCache(path) {
         if (path) {
           this.cache.invalidate(this.buildUrl(path).toString());
@@ -190,10 +435,10 @@ var init_api_client = __esm({
 
 // src/lib/skills.ts
 import { createHash } from "crypto";
-import { lstat, mkdir, readdir, readFile, rm, writeFile } from "fs/promises";
+import { lstat, mkdir as mkdir2, readdir, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { existsSync } from "fs";
-import { homedir } from "os";
-import { dirname, join, relative, resolve, sep } from "path";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2, relative, resolve, sep } from "path";
 function sha256(content) {
   return createHash("sha256").update(content, "utf8").digest("hex");
 }
@@ -210,12 +455,12 @@ function frontmatterName(skillMd) {
   return line ? line[1].replace(/^(['"])(.*)\1$/, "$2") : void 0;
 }
 function defaultSkillDir(name) {
-  return join(homedir(), ".claude", "skills", name);
+  return join2(homedir2(), ".claude", "skills", name);
 }
 async function walk(root, { skipHidden }, dir = root, out = { files: [], links: [], hidden: [] }) {
   for (const entry of await readdir(dir, { withFileTypes: true })) {
     if (SKIPPED.has(entry.name) || entry.name.endsWith(".pyc")) continue;
-    const full = join(dir, entry.name);
+    const full = join2(dir, entry.name);
     const rel = relative(root, full).split(sep).join("/");
     if (entry.isSymbolicLink()) out.links.push(rel);
     else if (skipHidden && entry.name.startsWith(".")) out.hidden.push(rel);
@@ -225,18 +470,9 @@ async function walk(root, { skipHidden }, dir = root, out = { files: [], links:
   out.files.sort();
   return out;
 }
-async function readSkillDirectory(directory) {
-  const root = resolve(directory);
-  if (!existsSync(join(root, ENTRY_FILE))) {
-    throw new Error(`${root} has no ${ENTRY_FILE}: a skill folder holds SKILL.md at its root`);
-  }
-  const walked = await walk(root, { skipHidden: true });
-  if (walked.links.length) {
-    throw new Error(`${walked.links.join(", ")}: links are not followed; copy the file into the skill folder`);
-  }
-  const paths = walked.files;
+async function readTextFiles(root, paths, what) {
   if (paths.length > MAX_FILES) {
-    throw new Error(`${root} holds ${paths.length} files: a skill holds at most ${MAX_FILES}`);
+    throw new Error(`${root} holds ${paths.length} files: ${what} holds at most ${MAX_FILES}`);
   }
   const decoder = new TextDecoder("utf-8", { fatal: true });
   const files = [];
@@ -245,8 +481,8 @@ async function readSkillDirectory(directory) {
     if (!isValidPath(path)) {
       throw new Error(`${path}: file names may use letters, digits, ".", "_" and "-" only`);
     }
-    const raw = await readFile(join(root, ...path.split("/")));
-    if (raw.includes(0)) throw new Error(`${path} is binary: a skill holds text files only`);
+    const raw = await readFile2(join2(root, ...path.split("/")));
+    if (raw.includes(0)) throw new Error(`${path} is binary: ${what} holds text files only`);
     if (raw.length > MAX_FILE_BYTES) {
       throw new Error(`${path} is ${raw.length} bytes: a file holds at most ${MAX_FILE_BYTES}`);
     }
@@ -262,6 +498,18 @@ async function readSkillDirectory(directory) {
     }
     files.push({ path, content });
   }
+  return files;
+}
+async function readSkillDirectory(directory) {
+  const root = resolve(directory);
+  if (!existsSync(join2(root, ENTRY_FILE))) {
+    throw new Error(`${root} has no ${ENTRY_FILE}: a skill folder holds SKILL.md at its root`);
+  }
+  const walked = await walk(root, { skipHidden: true });
+  if (walked.links.length) {
+    throw new Error(`${walked.links.join(", ")}: links are not followed; copy the file into the skill folder`);
+  }
+  const files = await readTextFiles(root, walked.files, "a skill");
   const skillMd = files.find((f) => f.path === ENTRY_FILE);
   const name = frontmatterName(skillMd.content);
   if (!name) throw new Error(`${ENTRY_FILE} has no frontmatter name`);
@@ -275,7 +523,7 @@ function within(dest, path) {
 }
 async function readManifest(dest) {
   try {
-    return JSON.parse(await readFile(join(dest, MANIFEST_FILE), "utf8"));
+    return JSON.parse(await readFile2(join2(dest, MANIFEST_FILE), "utf8"));
   } catch {
     return void 0;
   }
@@ -299,7 +547,7 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
   const edited = [];
   const untracked = [];
   for (const path of present) {
-    const content = await readFile(join(dest, ...path.split("/")), "utf8");
+    const content = await readFile2(join2(dest, ...path.split("/")), "utf8");
     if (Object.hasOwn(known, path)) {
       if (sha256(content) !== known[path]) edited.push(path);
     } else if (!incoming.has(path) || sha256(content) !== incoming.get(path).sha256) {
@@ -312,8 +560,8 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
   const written = [];
   for (const f of version.files) {
     const full = within(dest, f.path);
-    await mkdir(dirname(full), { recursive: true });
-    await writeFile(full, f.content, "utf8");
+    await mkdir2(dirname2(full), { recursive: true });
+    await writeFile2(full, f.content, "utf8");
     written.push(f.path);
   }
   const removed = [];
@@ -324,7 +572,7 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
       keptEdited.push(path);
       continue;
     }
-    await rm(within(dest, path));
+    await rm2(within(dest, path));
     removed.push(path);
   }
   const next = {
@@ -333,7 +581,7 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
     installedAt: (/* @__PURE__ */ new Date()).toISOString(),
     files: Object.fromEntries(version.files.map((f) => [f.path, f.sha256]))
   };
-  await writeFile(join(dest, MANIFEST_FILE), JSON.stringify(next, null, 2) + "\n", "utf8");
+  await writeFile2(join2(dest, MANIFEST_FILE), JSON.stringify(next, null, 2) + "\n", "utf8");
   return {
     dest,
     version: version.version,
@@ -343,8 +591,8 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
     keptEdited
   };
 }
-function fenceFor(text2) {
-  const longest = Math.max(0, ...(text2.match(/`+/g) ?? []).map((r) => r.length));
+function fenceFor(text3) {
+  const longest = Math.max(0, ...(text3.match(/`+/g) ?? []).map((r) => r.length));
   return "`".repeat(Math.max(3, longest + 1));
 }
 function describeInstall(name, r) {
@@ -469,6 +717,226 @@ var init_install_skill = __esm({
   }
 });
 
+// src/plugin-path.ts
+var plugin_path_exports = {};
+__export(plugin_path_exports, {
+  MAX_UNPACKED_BYTES: () => MAX_UNPACKED_BYTES,
+  PLUGIN_PATH_USAGE: () => PLUGIN_PATH_USAGE,
+  PluginRefused: () => PluginRefused,
+  parsePluginPathArgs: () => parsePluginPathArgs,
+  readZipEntries: () => readZipEntries,
+  runPluginPath: () => runPluginPath,
+  unpackZip: () => unpackZip
+});
+import { createHash as createHash2, randomBytes } from "crypto";
+import { existsSync as existsSync2 } from "fs";
+import { mkdir as mkdir3, rename as rename2, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, join as join3, resolve as resolve3, sep as sep2 } from "path";
+import { inflateRawSync } from "zlib";
+function parsePluginPathArgs(argv) {
+  const args2 = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--version" || a === "--sha256") {
+      const value = argv[++i];
+      if (!value) throw new Error(`${a} needs a value
+${PLUGIN_PATH_USAGE}`);
+      if (a === "--sha256") {
+        if (!SHA256_RE.test(value)) throw new Error(`--sha256 must be 64 lowercase hex characters, got ${value}`);
+        args2.sha256 = value;
+      } else if (/^[1-9]\d{0,8}$/.test(value)) args2.version = Number(value);
+      else throw new Error(`--version must be a whole number, got ${value}`);
+    } else if (a.startsWith("-")) throw new Error(`Unknown option ${a}
+${PLUGIN_PATH_USAGE}`);
+    else if (!args2.workspace) args2.workspace = a;
+    else throw new Error(`Unexpected argument ${a}
+${PLUGIN_PATH_USAGE}`);
+  }
+  if (!args2.workspace || !args2.version || !args2.sha256) throw new Error(PLUGIN_PATH_USAGE);
+  if (!isWorkspace(args2.workspace)) throw new Error(`${args2.workspace} is not a workspace name`);
+  return args2;
+}
+function refuse(name, why) {
+  throw new PluginRefused(`refused the plugin entry ${JSON.stringify(name)}: it ${why}. Nothing was unpacked.`);
+}
+function readZipEntries(zip) {
+  let eocd = -1;
+  for (let i = zip.length - 22; i >= Math.max(0, zip.length - 22 - 65535); i--) {
+    if (zip.readUInt32LE(i) === EOCD) {
+      eocd = i;
+      break;
+    }
+  }
+  if (eocd < 0) throw new PluginRefused("the download is not a zip. Nothing was unpacked.");
+  const count = zip.readUInt16LE(eocd + 10);
+  let at = zip.readUInt32LE(eocd + 16);
+  if (count === 65535 || at === 4294967295) throw new PluginRefused("the zip is a ZIP64 archive, which a plugin never is. Nothing was unpacked.");
+  const entries = [];
+  let total = 0;
+  for (let n = 0; n < count; n++) {
+    if (at + 46 > zip.length || zip.readUInt32LE(at) !== CENTRAL) {
+      throw new PluginRefused("the zip's directory is damaged. Nothing was unpacked.");
+    }
+    const madeBy = zip.readUInt16LE(at + 4);
+    const flags = zip.readUInt16LE(at + 8);
+    const method = zip.readUInt16LE(at + 10);
+    const compressedSize = zip.readUInt32LE(at + 20);
+    const size = zip.readUInt32LE(at + 24);
+    const nameLength = zip.readUInt16LE(at + 28);
+    const extraLength = zip.readUInt16LE(at + 30);
+    const commentLength = zip.readUInt16LE(at + 32);
+    const external = zip.readUInt32LE(at + 38);
+    const offset = zip.readUInt32LE(at + 42);
+    const name = zip.subarray(at + 46, at + 46 + nameLength).toString(flags & 2048 ? "utf8" : "latin1");
+    at += 46 + nameLength + extraLength + commentLength;
+    const unixMode = madeBy >> 8 === 3 ? external >>> 16 : 0;
+    const segments = name.split(/[\\/]/);
+    if (!name || /^[\\/]/.test(name) || /^[A-Za-z]:/.test(name)) refuse(name, "is absolute");
+    if (segments.includes("..")) refuse(name, "climbs out of the plugin folder (..)");
+    if (name.includes(":") || name.includes("\0")) refuse(name, "is not a plain relative path");
+    if ((unixMode & S_IFMT) === S_IFLNK) refuse(name, "is a link");
+    const directory = name.endsWith("/") || (unixMode & S_IFMT) === S_IFDIR;
+    if (!directory && unixMode && (unixMode & S_IFMT) !== S_IFREG) refuse(name, "is not a regular file");
+    if (flags & 1) refuse(name, "is encrypted");
+    if (!directory && method !== 0 && method !== 8) refuse(name, `uses compression method ${method}`);
+    total += size;
+    if (total > MAX_UNPACKED_BYTES) refuse(name, `takes the unpacked size past ${MAX_UNPACKED_BYTES} bytes`);
+    entries.push({ name, directory, mode: unixMode ? unixMode & 511 : void 0, method, compressedSize, size, offset });
+  }
+  return entries;
+}
+function entryData(zip, entry) {
+  const at = entry.offset;
+  if (at + 30 > zip.length || zip.readUInt32LE(at) !== LOCAL) refuse(entry.name, "has a damaged header");
+  const start = at + 30 + zip.readUInt16LE(at + 26) + zip.readUInt16LE(at + 28);
+  const raw = zip.subarray(start, start + entry.compressedSize);
+  let data;
+  try {
+    data = entry.method === 0 ? raw : inflateRawSync(raw, { maxOutputLength: Math.max(1, entry.size) + 1 });
+  } catch (e) {
+    refuse(entry.name, `cannot be unpacked (${e.message})`);
+  }
+  if (data.length !== entry.size) refuse(entry.name, "unpacks to a size other than the one it declares");
+  return data;
+}
+async function unpackZip(zip, dest) {
+  const entries = readZipEntries(zip);
+  const root = resolve3(dest);
+  const targets = entries.map((e) => {
+    const full = resolve3(root, ...e.name.split(/[\\/]/).filter(Boolean));
+    if (full !== root && !full.startsWith(root + sep2)) refuse(e.name, "climbs out of the plugin folder");
+    return full;
+  });
+  const data = entries.map((e) => e.directory ? void 0 : entryData(zip, e));
+  await mkdir3(root, { recursive: true });
+  for (const [i, entry] of entries.entries()) {
+    if (entry.directory) {
+      await mkdir3(targets[i], { recursive: true });
+      continue;
+    }
+    await mkdir3(dirname3(targets[i]), { recursive: true });
+    await writeFile3(targets[i], data[i], { mode: entry.mode ?? 420 });
+  }
+  return entries.filter((e) => !e.directory).length;
+}
+async function runPluginPath(argv, io) {
+  let args2;
+  try {
+    args2 = parsePluginPathArgs(argv);
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  const { workspace, version, sha256: sha2562 } = args2;
+  const folder = pluginDir(workspace, version);
+  try {
+    const state = await readState(workspace);
+    if (existsSync2(folder) && state.plugin?.[String(version)]?.sha256 === sha2562) {
+      io.out(folder);
+      return 0;
+    }
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  let client = io.client;
+  if (!client) {
+    try {
+      const apiUrl = apiUrlFrom();
+      const apiKey = await apiKeyFor(workspace);
+      if (!apiKey) {
+        io.err(
+          `No SystemDox key for ${workspace}. Set SYSTEMDOX_API_KEY, or run npx -y @systemdox/mcp-server setup, then run this again.`
+        );
+        return 1;
+      }
+      client = new SystemDoxApiClient({ apiKey, apiUrl, cacheTtlMs: 0, defaultOrg: void 0 });
+    } catch (e) {
+      io.err(e.message);
+      return 1;
+    }
+  }
+  let zip;
+  try {
+    ({ bytes: zip } = await client.getPluginZip(workspace, version));
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  const got = createHash2("sha256").update(zip).digest("hex");
+  if (got !== sha2562) {
+    io.err(
+      `The download of ${workspace}'s team plugin version ${version} has SHA-256 ${got}, not the ${sha2562} Claude Code named. Nothing was unpacked.`
+    );
+    return 2;
+  }
+  const tmp = join3(pluginRoot(workspace), `.${version}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`);
+  try {
+    await unpackZip(zip, tmp);
+    if (existsSync2(folder) && (await readState(workspace)).plugin?.[String(version)]?.sha256 === sha2562) {
+      await removeFolder(tmp);
+    } else {
+      if (existsSync2(folder)) await removeFolder(folder);
+      try {
+        await rename2(tmp, folder);
+      } catch (e) {
+        if (!existsSync2(folder)) throw e;
+        await removeFolder(tmp);
+      }
+    }
+    await updateState(workspace, (state) => {
+      state.plugin = { ...state.plugin, [String(version)]: { sha256: sha2562, installedAt: (/* @__PURE__ */ new Date()).toISOString() } };
+    });
+  } catch (e) {
+    await removeFolder(tmp);
+    io.err(e.message);
+    return e instanceof PluginRefused ? 2 : 1;
+  }
+  io.err(`Unpacked ${workspace}'s team plugin version ${version}.`);
+  io.out(folder);
+  return 0;
+}
+var PLUGIN_PATH_USAGE, MAX_UNPACKED_BYTES, SHA256_RE, PluginRefused, EOCD, CENTRAL, LOCAL, S_IFMT, S_IFLNK, S_IFDIR, S_IFREG;
+var init_plugin_path = __esm({
+  "src/plugin-path.ts"() {
+    "use strict";
+    init_api_client();
+    init_team_setup_files();
+    PLUGIN_PATH_USAGE = "Usage: systemdox-mcp-server plugin-path <workspace> --version <n> --sha256 <hash>";
+    MAX_UNPACKED_BYTES = 20 * 1024 * 1024;
+    SHA256_RE = /^[0-9a-f]{64}$/;
+    PluginRefused = class extends Error {
+    };
+    EOCD = 101010256;
+    CENTRAL = 33639248;
+    LOCAL = 67324752;
+    S_IFMT = 61440;
+    S_IFLNK = 40960;
+    S_IFDIR = 16384;
+    S_IFREG = 32768;
+  }
+});
+
 // src/lib/language.ts
 function detectLanguage(filePath) {
   const ext = filePath.slice(filePath.lastIndexOf("."));
@@ -601,12 +1069,12 @@ function registerGetGuardrails(server2, apiClient2) {
       );
     }
     if (filtered.length === 0) {
-      const text3 = guardrails.length === 0 ? `No checks found. Add checks at ${configLink("/docs/guardrails", await workspaceBase(apiClient2))}` : `No checks found${lang ? ` for language "${lang}"` : ""}${category ? ` in category "${category}"` : ""}.`;
+      const text4 = guardrails.length === 0 ? `No checks found. Add checks at ${configLink("/docs/guardrails", await workspaceBase(apiClient2))}` : `No checks found${lang ? ` for language "${lang}"` : ""}${category ? ` in category "${category}"` : ""}.`;
       return {
-        content: [{ type: "text", text: text3 }]
+        content: [{ type: "text", text: text4 }]
       };
     }
-    const text2 = filtered.map(
+    const text3 = filtered.map(
       (g) => `## ${g.title} [${g.severity}]
 
 ${g.description}
@@ -630,7 +1098,7 @@ ${g.fix}
           type: "text",
           text: `Found ${filtered.length} check(s):
 
-${text2}`
+${text3}`
         }
       ]
     };
@@ -741,7 +1209,7 @@ ${spec.taskContent}`);
           ]
         };
       }
-      const text2 = filtered.map(
+      const text3 = filtered.map(
         (s) => `- **${s.name}** (${s.draftId}) \u2014 ${s.status}, ${s.requirementCount} requirements` + (s.repoFullName ? `, repo: ${s.repoFullName}` : "")
       ).join("\n");
       return {
@@ -750,7 +1218,7 @@ ${spec.taskContent}`);
             type: "text",
             text: `Found ${filtered.length} spec(s):
 
-${text2}`
+${text3}`
           }
         ]
       };
@@ -808,18 +1276,18 @@ function registerGetDocs(server2, apiClient2) {
             isError: true
           };
         }
-        let text3 = doc.content;
+        let text4 = doc.content;
         if (anchor && doc.section_resolved === false) {
-          text3 = `_Section "${anchor}" not found \u2014 returning the full document._
+          text4 = `_Section "${anchor}" not found \u2014 returning the full document._
 
-` + text3;
+` + text4;
         } else if (anchor && doc.heading) {
-          text3 = `## ${doc.heading}
+          text4 = `## ${doc.heading}
 
 ${doc.content}`;
         }
         return {
-          content: [{ type: "text", text: text3 }]
+          content: [{ type: "text", text: text4 }]
         };
       }
       const params = {};
@@ -843,7 +1311,7 @@ ${doc.content}`;
           ]
         };
       }
-      const text2 = items.map((d) => {
+      const text3 = items.map((d) => {
         const sections = (d.outline ?? []).slice(0, 8);
         const sectionHint = sections.length > 0 ? `
   sections: ${sections.map((s) => s.anchor).join(", ")}` : "";
@@ -857,7 +1325,7 @@ ${doc.content}`;
             type: "text",
             text: `Found ${items.length} document(s) (${response.total} total):
 
-${text2}
+${text3}
 
 Use doc_id for full content, or doc_id + section to fetch one section.`
           }
@@ -1202,13 +1670,13 @@ var init_get_plan_board = __esm({
 });
 
 // src/lib/scoring.ts
-function estimateTokens(text2) {
-  return Math.ceil(text2.length / CHARS_PER_TOKEN);
+function estimateTokens(text3) {
+  return Math.ceil(text3.length / CHARS_PER_TOKEN);
 }
-function truncateToTokens(text2, maxTokens) {
+function truncateToTokens(text3, maxTokens) {
   const maxChars = Math.max(0, maxTokens) * CHARS_PER_TOKEN;
-  if (text2.length <= maxChars) return { text: text2, truncated: false };
-  const head = text2.slice(0, maxChars);
+  if (text3.length <= maxChars) return { text: text3, truncated: false };
+  const head = text3.slice(0, maxChars);
   const floor = Math.floor(maxChars * 0.75);
   const paragraph = head.lastIndexOf("\n\n");
   const line = head.lastIndexOf("\n");
@@ -1253,7 +1721,7 @@ function scoreSeverity(item) {
   if (!item.severity) return 0.5;
   return SEVERITY_SCORES[item.severity] ?? 0.5;
 }
-function extractKeywords(text2) {
+function extractKeywords(text3) {
   const stopWords = /* @__PURE__ */ new Set([
     "the",
     "a",
@@ -1338,7 +1806,7 @@ function extractKeywords(text2) {
     "implement",
     "create"
   ]);
-  return text2.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !stopWords.has(w));
+  return text3.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !stopWords.has(w));
 }
 function scoreItems(items, taskDescription, filePaths) {
   const languages = detectLanguages(filePaths);
@@ -1391,20 +1859,20 @@ var init_scoring = __esm({
 
 // src/lib/context-builder.ts
 function formatGuardrail(g) {
-  let text2 = `## ${g.title} [${g.severity}]
+  let text3 = `## ${g.title} [${g.severity}]
 
 ${g.description}`;
-  if (g.pattern) text2 += `
+  if (g.pattern) text3 += `
 
 **Bad:** \`\`\`
 ${g.pattern}
 \`\`\``;
-  if (g.fix) text2 += `
+  if (g.fix) text3 += `
 
 **Good:** \`\`\`
 ${g.fix}
 \`\`\``;
-  return text2;
+  return text3;
 }
 function formatSpecHeadline(s) {
   return `### ${s.name}
@@ -1426,19 +1894,19 @@ function formatRules(rules) {
     if (!byCategory.has(cat)) byCategory.set(cat, []);
     byCategory.get(cat).push(r);
   }
-  let text2 = "";
+  let text3 = "";
   for (const [cat, catRules] of byCategory) {
-    text2 += `### ${cat.charAt(0).toUpperCase() + cat.slice(1)}
+    text3 += `### ${cat.charAt(0).toUpperCase() + cat.slice(1)}
 `;
     for (const r of catRules) {
-      text2 += `- ${r.text}
+      text3 += `- ${r.text}
 `;
     }
-    text2 += "\n";
+    text3 += "\n";
   }
   return `## Project Rules (${rules.length})
 
-${text2.trim()}`;
+${text3.trim()}`;
 }
 async function fetchSpecBody(api, draftId) {
   const spec = await api.get(
@@ -1792,13 +2260,13 @@ function registerGetContext(server2, apiClient2) {
       }
     },
     async ({ task_description, file_paths, max_tokens }) => {
-      const { text: text2 } = await buildContext(apiClient2, {
+      const { text: text3 } = await buildContext(apiClient2, {
         taskDescription: task_description,
         filePaths: file_paths,
         maxTokens: max_tokens
       });
       return {
-        content: [{ type: "text", text: text2 }]
+        content: [{ type: "text", text: text3 }]
       };
     }
   );
@@ -2061,9 +2529,9 @@ function registerGetProjectRules(server2, apiClient2) {
         );
       }
       if (filtered.length === 0) {
-        const text3 = rules.length === 0 ? `No project rules found. Add rules at ${configLink("/docs/rules", await workspaceBase(apiClient2))}` : `No project rules found${category ? ` in category "${category}"` : ""}.`;
+        const text4 = rules.length === 0 ? `No project rules found. Add rules at ${configLink("/docs/rules", await workspaceBase(apiClient2))}` : `No project rules found${category ? ` in category "${category}"` : ""}.`;
         return {
-          content: [{ type: "text", text: text3 }]
+          content: [{ type: "text", text: text4 }]
         };
       }
       const grouped = /* @__PURE__ */ new Map();
@@ -2072,25 +2540,25 @@ function registerGetProjectRules(server2, apiClient2) {
         if (!grouped.has(cat)) grouped.set(cat, []);
         grouped.get(cat).push(rule);
       }
-      let text2 = `Found ${filtered.length} project rule(s):
+      let text3 = `Found ${filtered.length} project rule(s):
 
 `;
       for (const [cat, catRules] of grouped) {
         const label = CATEGORY_LABELS[cat] ?? cat;
-        text2 += `## ${label}
+        text3 += `## ${label}
 
 `;
         for (const rule of catRules) {
-          text2 += `- ${rule.text}
+          text3 += `- ${rule.text}
 `;
         }
-        text2 += "\n";
+        text3 += "\n";
       }
       return {
         content: [
           {
             type: "text",
-            text: text2
+            text: text3
           }
         ]
       };
@@ -2131,10 +2599,10 @@ function registerCreateProjectRule(server2, apiClient2) {
         readOnlyHint: false
       }
     },
-    async ({ text: text2, category }) => {
+    async ({ text: text3, category }) => {
       const saved = await apiClient2.post(
         "/v1/standards/rules",
-        { text: text2, category }
+        { text: text3, category }
       );
       apiClient2.invalidateCache("/v1/standards/rules");
       return {
@@ -2177,7 +2645,7 @@ function registerGetPromptTemplates(server2, apiClient2) {
           ]
         };
       }
-      const text2 = templates.map(
+      const text3 = templates.map(
         (t) => `## ${t.name}
 
 ` + (t.description ? `*${t.description}*
@@ -2192,7 +2660,7 @@ ${t.prompt}
             type: "text",
             text: `Found ${templates.length} prompt template(s):
 
-${text2}`
+${text3}`
           }
         ]
       };
@@ -2252,10 +2720,10 @@ var init_create_prompt_template = __esm({
 
 // src/tools/skills.ts
 import { z as z13 } from "zod";
-import { homedir as homedir2 } from "os";
-import { basename as basename2, resolve as resolve3 } from "path";
+import { homedir as homedir3 } from "os";
+import { basename as basename2, resolve as resolve4 } from "path";
 function expandHome(path) {
-  return path.replace(/^~(?=$|[\\/])/, homedir2());
+  return path.replace(/^~(?=$|[\\/])/, homedir3());
 }
 function text(t) {
   return { content: [{ type: "text", text: t }] };
@@ -2357,7 +2825,7 @@ Left out (hidden files are never part of a skill): ${skipped.join(", ")}` : "")
       );
       if (localFiles) {
         const dest2 = args2.target ? expandHome(args2.target) : defaultSkillDir(version.name);
-        if (basename2(resolve3(dest2)) !== version.name) {
+        if (basename2(resolve4(dest2)) !== version.name) {
           throw new Error(`target must be a folder named ${version.name} (e.g. .claude/skills/${version.name}); got ${dest2}`);
         }
         const result = await installSkill(version, dest2, { overwrite: args2.overwrite });
@@ -2401,6 +2869,203 @@ var init_skills2 = __esm({
   }
 });
 
+// src/lib/person-values.ts
+var W, D, WORD_OR, PERSON_ID, PERSON_TOKEN, BEFORE, AFTER, E164, NATIONAL, ATEXT, EMAIL_RE, HOME_PREFIX, HOME, KEY_PREFIX;
+var init_person_values = __esm({
+  "src/lib/person-values.ts"() {
+    "use strict";
+    W = "[\\p{L}\\p{N}_]";
+    D = "\\p{Nd}";
+    WORD_OR = (extra) => `[\\p{L}\\p{N}_${extra}]`;
+    PERSON_ID = "(?:con|ctc|usr)_[0-9A-Za-z]{10,40}";
+    PERSON_TOKEN = `\`${PERSON_ID}\`(?:[ \\t]*\\([^()\\n]*\\))?`;
+    BEFORE = `(?<!${WORD_OR("+.:/\\\\\\-")})(?<!${D}[ -])`;
+    AFTER = `(?!${WORD_OR(":/\\\\")}|\\.${D}|[ -]?${D}|-${W})`;
+    E164 = `${BEFORE}\\+${D}+(?:[ -]${D}+)*${AFTER}`;
+    NATIONAL = `${BEFORE}0${D}*(?:[ -]${D}+)*${AFTER}`;
+    ATEXT = "[A-Za-z0-9!#$%&'*+/=?^_{|}~\\-]";
+    EMAIL_RE = "(?<![A-Za-z0-9!#$%&*+/=?^_{|}~.@\\-])[A-Za-z0-9_]" + ATEXT + "*(?:\\." + ATEXT + "+)*@(?:[A-Za-z0-9](?:[A-Za-z0-9\\-]{0,61}[A-Za-z0-9])?\\.)+[A-Za-z]{2,63}(?![A-Za-z0-9\\-]|\\.[A-Za-z0-9])";
+    HOME_PREFIX = "(?:[A-Za-z]:\\\\+Users\\\\+|[A-Za-z]:/+Users/+|/Users/|/home/)";
+    HOME = `(?<!${WORD_OR(".~:/\\\\$}\\-")})${HOME_PREFIX}[^\\\\/\\s"'\`<>|:*?]+`;
+    KEY_PREFIX = `(?<!${W})(?:pweb_[a-z]+_key_|sk-ant-|sk_live_|rk_live_|github_pat_|gh[pousr]_|sntrys_|xox[baprs]-)[A-Za-z0-9_\\-]{4,}`;
+  }
+});
+
+// src/lib/team-setup-types.ts
+var PARTS, PERSON_ID_RE;
+var init_team_setup_types = __esm({
+  "src/lib/team-setup-types.ts"() {
+    "use strict";
+    init_person_values();
+    PARTS = ["hooks", "mcp", "agents", "commands", "instructions"];
+    PERSON_ID_RE = new RegExp(`^${PERSON_ID}$`);
+  }
+});
+
+// src/tools/team-setup.ts
+import { z as z14 } from "zod";
+import { existsSync as existsSync3 } from "fs";
+import { lstat as lstat2 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { join as join4, resolve as resolve5 } from "path";
+function expandHome2(path) {
+  return path.replace(/^~(?=$|[\\/])/, homedir4());
+}
+function text2(t) {
+  return { content: [{ type: "text", text: t }] };
+}
+async function isLink(path) {
+  try {
+    return (await lstat2(path)).isSymbolicLink();
+  } catch (e) {
+    if (e.code === "ENOENT") return false;
+    throw e;
+  }
+}
+async function readPartDirectory(part, directory) {
+  const root = resolve5(directory);
+  const layout = LAYOUT[part];
+  const paths = [];
+  const leftOut = [];
+  const links = [];
+  for (const path of layout.files) {
+    const segments = path.split("/");
+    let present = true;
+    for (let i = 1; i <= segments.length; i++) {
+      const rel = segments.slice(0, i).join("/");
+      if (await isLink(join4(root, ...segments.slice(0, i)))) {
+        links.push(rel);
+        present = false;
+        break;
+      }
+    }
+    if (present && existsSync3(join4(root, ...segments))) paths.push(path);
+  }
+  for (const { dir, md } of layout.folders) {
+    const full = join4(root, dir);
+    if (await isLink(full)) {
+      links.push(dir);
+      continue;
+    }
+    if (!existsSync3(full)) continue;
+    const walked = await walk(full, { skipHidden: true });
+    links.push(...walked.links.map((p) => `${dir}/${p}`));
+    leftOut.push(...walked.hidden.map((p) => `${dir}/${p}`));
+    for (const p of walked.files) {
+      if (md && !p.endsWith(".md")) leftOut.push(`${dir}/${p}`);
+      else paths.push(`${dir}/${p}`);
+    }
+  }
+  if (links.length) {
+    throw new Error(
+      `${links.join(", ")}: links are not followed; copy the file into the folder. Nothing was sent.`
+    );
+  }
+  if (layout.required && !paths.includes(layout.required)) {
+    throw new Error(`${root} has no ${layout.required}: the ${part} part needs it. Nothing was sent.`);
+  }
+  if (!paths.length) {
+    throw new Error(
+      `${root} has no ${layout.folders.map((f) => `${f.dir}/*.md`).join(" or ")}: nothing to publish for ${part}.`
+    );
+  }
+  return { files: await readTextFiles(root, paths.sort(), `the ${part} part`), leftOut };
+}
+function describePerson(id, person) {
+  const lines = [`**${person.label ?? "(no label)"}**, \`${id}\``];
+  if (person.mergedInto) {
+    lines.push(`\`${id}\` was merged into \`${person.mergedInto}\`: these are \`${person.mergedInto}\`'s details.`);
+  }
+  lines.push(`- Name: ${person.name ?? "(none held)"}`);
+  lines.push(`- Phone number: ${person.phone ?? "(none held)"}`);
+  lines.push(`- Email address: ${person.email ?? "(none held)"}`);
+  const token = `\`${person.mergedInto ?? id}\`${person.label ? ` (${person.label})` : ""}`;
+  lines.push(
+    "",
+    `These details are for this session only. Do not write them into a memory file, a note or a commit: a memory names this person by the identifier, as ${token}. A memory file that holds the details is offered for rewriting again at the next sync.`
+  );
+  return lines.join("\n");
+}
+function registerTeamSetupTools(server2, apiClient2, { localFiles }) {
+  const fileSchema = z14.object({
+    path: z14.string().describe(`Path inside the part's folder, forward slashes, e.g. "hooks/hooks.json"`),
+    content: z14.string().describe("The file's full text, exactly as it is")
+  });
+  server2.registerTool(
+    "publish_setup_part",
+    {
+      title: "Publish Setup Part",
+      description: "Publish one part of your team's Claude Code setup to SystemDox: `hooks` (hooks/hooks.json and the scripts/ it calls), `mcp` (.mcp.json), `agents` (agents/*.md), `commands` (commands/*.md) or `instructions` (CLAUDE.md). Every part but instructions makes a new version of the team plugin, which each member accepts at their next update. Publishing hooks, mcp, agents or commands needs the admin role. " + (localFiles ? "Pass `directory`: the server reads only the files the part accepts, byte for byte, and refuses a link, a binary file or a file too large before anything is sent. Never retype the files into `files` when the folder is on this computer." : "Pass every file of the part in `files`, exactly as it is."),
+      inputSchema: {
+        part: z14.enum(PARTS).describe("Which part of the setup"),
+        ...localFiles ? {
+          directory: z14.string().optional().describe(
+            "The folder on this computer: for hooks, the one holding hooks/hooks.json and scripts/; for mcp, the one holding .mcp.json; for instructions, the one holding CLAUDE.md; for agents or commands, the one holding agents/ or commands/"
+          )
+        } : {},
+        files: z14.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the part")
+      },
+      annotations: { readOnlyHint: false }
+    },
+    async (args2) => {
+      let files;
+      let leftOut = [];
+      if (localFiles && args2.directory) {
+        ({ files, leftOut } = await readPartDirectory(args2.part, expandHome2(args2.directory)));
+      } else if (args2.files?.length) {
+        files = args2.files;
+      } else {
+        throw new Error(localFiles ? "Pass `directory` (or `files`)." : "Pass `files`.");
+      }
+      const { workspace } = await apiClient2.getOwnTeamSetup();
+      const saved = await apiClient2.publishPartVersion(workspace, args2.part, files);
+      const lines = [`Published **${saved.part}** version ${saved.version}.`];
+      if (saved.part !== "instructions" && saved.pluginVersion !== void 0) {
+        lines.push(`Team plugin version ${saved.pluginVersion}; each member accepts it at their next update.`);
+      }
+      if (saved.replacedValues?.length) {
+        lines.push(
+          "Replaced by a reference to each member's own environment variable:",
+          ...saved.replacedValues.map((r) => `- ${r.server} ${r.field} ${r.name}: \${${r.name}}`)
+        );
+      }
+      if (leftOut.length) lines.push(`Left out (not part of ${args2.part}): ${leftOut.join(", ")}`);
+      return text2(lines.join("\n"));
+    }
+  );
+  server2.registerTool(
+    "resolve_person",
+    {
+      title: "Resolve Person",
+      description: "Read back a person that a team memory names by identifier, written as `con_\u2026` (label), `ctc_\u2026` or `usr_\u2026`: their label, name, phone number and email address, from the vault that holds them. The details are for this session only: never write them into a memory file; the memory keeps the identifier. Writes nothing.",
+      inputSchema: {
+        id: z14.string().regex(PERSON_ID_RE, "a con_, ctc_ or usr_ identifier, as written in the memory").describe("The identifier, e.g. con_01JC2Q8Y4M7T0X3K5N9P2R6S8V")
+      },
+      annotations: { readOnlyHint: true }
+    },
+    async (args2) => {
+      const { workspace } = await apiClient2.getOwnTeamSetup();
+      const person = await apiClient2.resolvePerson(workspace, args2.id);
+      return text2(describePerson(args2.id, person));
+    }
+  );
+}
+var LAYOUT;
+var init_team_setup = __esm({
+  "src/tools/team-setup.ts"() {
+    "use strict";
+    init_skills();
+    init_team_setup_types();
+    LAYOUT = {
+      hooks: { files: ["hooks/hooks.json"], folders: [{ dir: "scripts", md: false }], required: "hooks/hooks.json" },
+      mcp: { files: [".mcp.json"], folders: [], required: ".mcp.json" },
+      agents: { files: [], folders: [{ dir: "agents", md: true }] },
+      commands: { files: [], folders: [{ dir: "commands", md: true }] },
+      instructions: { files: ["CLAUDE.md"], folders: [], required: "CLAUDE.md" }
+    };
+  }
+});
+
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 function createServer(apiClient2, { localFiles = false } = {}) {
@@ -2423,6 +3088,7 @@ function createServer(apiClient2, { localFiles = false } = {}) {
   registerCreateProjectRule(server2, apiClient2);
   registerCreatePromptTemplate(server2, apiClient2);
   registerSkillTools(server2, apiClient2, { localFiles });
+  registerTeamSetupTools(server2, apiClient2, { localFiles });
   return server2;
 }
 var SERVER_VERSION;
@@ -2444,7 +3110,8 @@ var init_server = __esm({
     init_get_prompt_templates();
     init_create_prompt_template();
     init_skills2();
-    SERVER_VERSION = true ? "0.1.45" : "0.0.0-dev";
+    init_team_setup();
+    SERVER_VERSION = true ? "0.1.46" : "0.0.0-dev";
   }
 });
 
@@ -2478,17 +3145,18 @@ var init_index = __esm({
 
 // src/cli.ts
 init_config();
-import { readFile as readFile2, writeFile as writeFile2, chmod } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join2 } from "path";
+init_team_setup_files();
+import { readFile as readFile3, writeFile as writeFile4, chmod as chmod2 } from "fs/promises";
+import { existsSync as existsSync4 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
 import { createInterface } from "readline";
 function prompt(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve4(answer.trim());
+      resolve6(answer.trim());
     });
   });
 }
@@ -2508,45 +3176,45 @@ async function validateApiKey(apiKey, apiUrl) {
 }
 function findConfigTargets() {
   const targets = [];
-  const projectMcp = join2(process.cwd(), ".mcp.json");
+  const projectMcp = join5(process.cwd(), ".mcp.json");
   targets.push({
     name: "Claude Code (project)",
     path: projectMcp,
     detected: true
     // Always available
   });
-  const claudeUser = join2(homedir3(), ".claude.json");
+  const claudeUser = join5(homedir5(), ".claude.json");
   targets.push({
     name: "Claude Code (user \u2014 all projects)",
     path: claudeUser,
     detected: true
     // Always available
   });
-  const cursorProject = join2(process.cwd(), ".cursor", "mcp.json");
-  const cursorDir = join2(process.cwd(), ".cursor");
+  const cursorProject = join5(process.cwd(), ".cursor", "mcp.json");
+  const cursorDir = join5(process.cwd(), ".cursor");
   targets.push({
     name: "Cursor (project)",
     path: cursorProject,
-    detected: existsSync2(cursorDir)
+    detected: existsSync4(cursorDir)
   });
-  const vscodeProject = join2(process.cwd(), ".vscode", "mcp.json");
-  const vscodeDir = join2(process.cwd(), ".vscode");
+  const vscodeProject = join5(process.cwd(), ".vscode", "mcp.json");
+  const vscodeDir = join5(process.cwd(), ".vscode");
   targets.push({
     name: "VS Code (project)",
     path: vscodeProject,
-    detected: existsSync2(vscodeDir)
+    detected: existsSync4(vscodeDir)
   });
-  const cursorGlobal = join2(homedir3(), ".cursor", "mcp.json");
+  const cursorGlobal = join5(homedir5(), ".cursor", "mcp.json");
   targets.push({
     name: "Cursor (global)",
     path: cursorGlobal,
-    detected: existsSync2(join2(homedir3(), ".cursor"))
+    detected: existsSync4(join5(homedir5(), ".cursor"))
   });
   return targets;
 }
 async function readOrCreateConfig(path) {
   try {
-    const content = await readFile2(path, "utf-8");
+    const content = await readFile3(path, "utf-8");
     return JSON.parse(content);
   } catch {
     return { mcpServers: {} };
@@ -2554,13 +3222,13 @@ async function readOrCreateConfig(path) {
 }
 async function writeConfig(path, config2) {
   const dir = path.substring(0, path.lastIndexOf("/"));
-  if (!existsSync2(dir)) {
-    const { mkdir: mkdir2 } = await import("fs/promises");
-    await mkdir2(dir, { recursive: true });
+  if (!existsSync4(dir)) {
+    const { mkdir: mkdir4 } = await import("fs/promises");
+    await mkdir4(dir, { recursive: true });
   }
-  await writeFile2(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
+  await writeFile4(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
   try {
-    await chmod(path, 384);
+    await chmod2(path, 384);
   } catch {
   }
 }
@@ -2636,7 +3304,7 @@ async function setup() {
     console.log(`  Configured: ${target.name}`);
   }
   console.log(
-    "\n  Done! Restart your AI coding tool to activate the SystemDox MCP server.\n  The server provides 17 tools: get_context, get_checks,\n  get_project_rules, get_prompt_templates, get_specs, get_docs,\n  get_tech_stack, get_planning_context, get_plan_board, create_check,\n  create_project_rule, create_prompt_template, update_spec,\n  report_decision, publish_skill, list_skills, install_skill.\n\n  get_guardrails and create_guardrail remain registered as deprecated\n  aliases of get_checks and create_check \u2014 existing configs keep working.\n"
+    "\n  Done! Restart your AI coding tool to activate the SystemDox MCP server.\n  The server provides 19 tools: get_context, get_checks,\n  get_project_rules, get_prompt_templates, get_specs, get_docs,\n  get_tech_stack, get_planning_context, get_plan_board, create_check,\n  create_project_rule, create_prompt_template, update_spec,\n  report_decision, publish_skill, list_skills, install_skill,\n  publish_setup_part, resolve_person.\n\n  get_guardrails and create_guardrail remain registered as deprecated\n  aliases of get_checks and create_check \u2014 existing configs keep working.\n"
   );
 }
 var args = process.argv.slice(2);
@@ -2652,6 +3320,12 @@ if (command === "setup") {
   Promise.resolve().then(() => (init_install_skill(), install_skill_exports)).then(
     ({ runInstallSkill: runInstallSkill2 }) => runInstallSkill2(args.slice(1), { out: console.log, err: console.error })
   ).then((code) => process.exit(code));
+} else if (command === "marketplace-auth") {
+  runMarketplaceAuth({ out: console.log, err: console.error }).then((code) => process.exit(code));
+} else if (command === "plugin-path") {
+  Promise.resolve().then(() => (init_plugin_path(), plugin_path_exports)).then(
+    ({ runPluginPath: runPluginPath2 }) => runPluginPath2(args.slice(1), { out: console.log, err: console.error })
+  ).then((code) => process.exit(code));
 } else if (command === "--help" || command === "-h") {
   console.log(`
   SystemDox MCP Server
@@ -2662,10 +3336,19 @@ if (command === "setup") {
     systemdox-mcp-server install-skill <name> [--version n] [--target dir] [--overwrite]
                                   Install a skill published to SystemDox
                                   (default folder: ~/.claude/skills/<name>)
+    systemdox-mcp-server plugin-path <workspace> --version <n> --sha256 <hash>
+                                  Print the folder of your team's plugin version,
+                                  downloading and checking it first when needed
+                                  (Claude Code runs it)
+    systemdox-mcp-server marketplace-auth
+                                  Print the header for your team's marketplace
+                                  (Claude Code runs it)
     systemdox-mcp-server --help   Show this help message
 
   Environment variables:
-    SYSTEMDOX_API_KEY             Your SystemDox API key (required)
+    SYSTEMDOX_API_KEY             Your SystemDox API key (required; plugin-path and
+                                  marketplace-auth also read
+                                  ~/.claude/systemdox/credentials.json)
     SYSTEMDOX_API_URL             API URL (default: ${API_URL_DEFAULT})
     SYSTEMDOX_CACHE_TTL           Cache TTL in seconds (default: 300)
     SYSTEMDOX_DEFAULT_ORG         Default GitHub org