@systemdox/mcp-server 0.1.45 → 0.1.47

package/dist/cli.js

@@ -51,6 +51,161 @@ var init_config = __esm({
   }
 });
 
+// src/lib/team-setup-files.ts
+import { execFile } from "child_process";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import { homedir, userInfo } from "os";
+import { dirname, join } from "path";
+import { promisify } from "util";
+function isWorkspace(value) {
+  return typeof value === "string" && value.length <= 64 && SLUG_RE.test(value);
+}
+function homeDir() {
+  return homedir();
+}
+function systemdoxDir() {
+  return join(homeDir(), ".claude", "systemdox");
+}
+function credentialsPath() {
+  return join(systemdoxDir(), "credentials.json");
+}
+function workspaceDir(workspace) {
+  if (!isWorkspace(workspace)) throw new Error(`${JSON.stringify(workspace)} is not a workspace name`);
+  return join(systemdoxDir(), workspace);
+}
+function statePath(workspace) {
+  return join(workspaceDir(workspace), "state.json");
+}
+function pluginRoot(workspace) {
+  return join(workspaceDir(workspace), "plugin");
+}
+function pluginDir(workspace, version) {
+  return join(pluginRoot(workspace), String(version));
+}
+async function readJson(path, empty) {
+  let text3;
+  try {
+    text3 = await readFile(path, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return empty;
+    throw e;
+  }
+  try {
+    return JSON.parse(text3);
+  } catch {
+    throw new Error(`${path} is not valid JSON: fix or remove it, then run this again`);
+  }
+}
+async function writeJsonAtomically(path, value, mode) {
+  await mkdir(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  await writeFile(tmp, JSON.stringify(value, null, 2) + "\n", mode === void 0 ? "utf8" : { encoding: "utf8", mode });
+  await rename(tmp, path);
+}
+async function readCredentials() {
+  return readJson(credentialsPath(), {});
+}
+async function restrictToMember(path) {
+  await chmod(path, 384);
+  if (process.platform === "win32") {
+    await run("icacls", [path, "/inheritance:r", "/grant:r", `${userInfo().username}:F`], { windowsHide: true });
+  }
+}
+async function writeCredentials(workspace, apiKey) {
+  if (!isWorkspace(workspace)) throw new Error(`${JSON.stringify(workspace)} is not a workspace name`);
+  if (!apiKey) throw new Error("an API key is required");
+  const path = credentialsPath();
+  const credentials = await readCredentials();
+  credentials[workspace] = { apiKey };
+  await writeJsonAtomically(path, credentials, 384);
+  await restrictToMember(path);
+}
+async function apiKeyFor(workspace, env = process.env) {
+  if (env.SYSTEMDOX_API_KEY) return env.SYSTEMDOX_API_KEY;
+  const entry = (await readCredentials())[workspace];
+  return typeof entry?.apiKey === "string" && entry.apiKey ? entry.apiKey : void 0;
+}
+function apiUrlFrom(env = process.env) {
+  return requireHttpsApiUrl(env.SYSTEMDOX_API_URL || API_URL_DEFAULT);
+}
+async function readState(workspace) {
+  return readJson(statePath(workspace), {});
+}
+async function writeState(workspace, state) {
+  await writeJsonAtomically(statePath(workspace), state);
+}
+async function updateState(workspace, change) {
+  const state = await readState(workspace);
+  change(state);
+  await writeState(workspace, state);
+  return state;
+}
+async function removeFolder(path) {
+  await rm(path, { recursive: true, force: true });
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function marketplaceWorkspace(marketplaceUrl, apiUrl) {
+  let url;
+  let api;
+  try {
+    url = new URL(marketplaceUrl);
+    api = new URL(requireHttpsApiUrl(apiUrl));
+  } catch {
+    return void 0;
+  }
+  if (url.protocol !== "https:" || url.origin !== api.origin || url.username || url.password) return void 0;
+  const base = api.pathname.replace(/\/+$/, "");
+  const m = new RegExp(`^${escapeRegExp(base)}/v1/team-setup/([^/]+)/marketplace\\.json$`).exec(url.pathname);
+  return m && isWorkspace(m[1]) ? m[1] : void 0;
+}
+async function runMarketplaceAuth(io, env = process.env) {
+  const url = env.CLAUDE_CODE_MARKETPLACE_URL;
+  if (!url) {
+    io.err("marketplace-auth: CLAUDE_CODE_MARKETPLACE_URL is not set; Claude Code sets it when it fetches a marketplace.");
+    return 1;
+  }
+  let apiUrl;
+  try {
+    apiUrl = apiUrlFrom(env);
+  } catch (e) {
+    io.err(`marketplace-auth: ${e.message}`);
+    return 1;
+  }
+  const workspace = marketplaceWorkspace(url, apiUrl);
+  if (!workspace) {
+    io.err(
+      `marketplace-auth: refusing to give a SystemDox key for ${url}: it is not a SystemDox team marketplace on ${apiUrl}`
+    );
+    return 1;
+  }
+  let key;
+  try {
+    key = await apiKeyFor(workspace, env);
+  } catch (e) {
+    io.err(`marketplace-auth: ${e.message}`);
+    return 1;
+  }
+  if (!key) {
+    io.err(
+      `marketplace-auth: no SystemDox key for ${workspace}. Set SYSTEMDOX_API_KEY, or run npx -y @systemdox/mcp-server setup.`
+    );
+    return 1;
+  }
+  io.out(JSON.stringify({ Authorization: `Bearer ${key}` }));
+  return 0;
+}
+var SLUG_RE, run;
+var init_team_setup_files = __esm({
+  "src/lib/team-setup-files.ts"() {
+    "use strict";
+    init_config();
+    SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+    run = promisify(execFile);
+  }
+});
+
 // src/lib/cache.ts
 var ResponseCache;
 var init_cache = __esm({
@@ -88,11 +243,33 @@ var init_cache = __esm({
 });
 
 // src/lib/api-client.ts
-var SystemDoxApiClient;
+var SystemDoxApiError, TEAM_SETUP, seg, SystemDoxApiClient;
 var init_api_client = __esm({
   "src/lib/api-client.ts"() {
     "use strict";
     init_cache();
+    SystemDoxApiError = class extends Error {
+      constructor(status, text3) {
+        super(`SystemDox API error ${status}: ${text3}`);
+        this.status = status;
+        this.text = text3;
+        let body;
+        try {
+          body = JSON.parse(text3);
+        } catch {
+          body = void 0;
+        }
+        this.body = body;
+        const code = body?.code;
+        this.code = typeof code === "string" ? code : /\b(SYD-[A-Z]\d{3})\b/.exec(text3)?.[1];
+      }
+      status;
+      text;
+      code;
+      body;
+    };
+    TEAM_SETUP = "/v1/team-setup";
+    seg = (s) => encodeURIComponent(String(s));
     SystemDoxApiClient = class {
       config;
       cache;
@@ -114,88 +291,1535 @@ var init_api_client = __esm({
         const cached = this.cache.get(cacheKey);
         if (cached !== void 0) return cached;
         const res = await this.fetchRaw(path, params);
-        if (!res.ok) {
-          const body = await res.text();
-          throw new Error(`SystemDox API error ${res.status}: ${body}`);
-        }
+        if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
         const data = await res.json();
         this.cache.set(cacheKey, data);
         return data;
       }
-      /** A read that skips the cache: an install must take the version that is
-       * latest now, not the one cached before someone published another. */
-      async getFresh(path) {
-        const res = await this.fetchRaw(path);
-        if (!res.ok) {
-          const body = await res.text();
-          throw new Error(`SystemDox API error ${res.status}: ${body}`);
+      /** A read that skips the cache: an install must take the version that is
+       * latest now, not the one cached before someone published another. */
+      async getFresh(path) {
+        const res = await this.fetchRaw(path);
+        if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
+        return await res.json();
+      }
+      async post(path, body) {
+        return this.mutate("POST", path, body);
+      }
+      async put(path, body) {
+        return this.mutate("PUT", path, body);
+      }
+      async mutate(method, path, body) {
+        const url = this.buildUrl(path);
+        const res = await fetch(url, {
+          method,
+          headers: {
+            // The API Gateway authorizer only reads the Authorization header;
+            // X-API-Key is kept for backwards compatibility.
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "X-API-Key": this.config.apiKey,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        });
+        if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
+        return await res.json();
+      }
+      // ── Team setup (ADR-217, specs/changes/team-setup/openapi.yaml) ──────────
+      // One method per operationId. Every read skips the cache: setup, sync and
+      // plugin-path act on what the workspace holds now.
+      /** getOwnTeamSetup: the key's own workspace, named in `workspace`. */
+      getOwnTeamSetup() {
+        return this.getFresh(TEAM_SETUP);
+      }
+      getTeamSetup(workspace) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}`);
+      }
+      getMarketplace(workspace) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/marketplace.json`);
+      }
+      getPart(workspace, part) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/parts/${seg(part)}`);
+      }
+      publishPartVersion(workspace, part, files) {
+        return this.post(`${TEAM_SETUP}/${seg(workspace)}/parts/${seg(part)}/versions`, { files });
+      }
+      getPartVersion(workspace, part, version) {
+        return this.getFresh(
+          `${TEAM_SETUP}/${seg(workspace)}/parts/${seg(part)}/versions/${seg(version)}`
+        );
+      }
+      getSetupSkills(workspace) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/skills`);
+      }
+      setSetupSkills(workspace, skills) {
+        return this.put(`${TEAM_SETUP}/${seg(workspace)}/skills`, { skills });
+      }
+      getPlugin(workspace) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/plugin`);
+      }
+      /** getPluginZip: the zip's bytes as served, and its X-Content-SHA256
+       * header. The caller checks the BYTES against the hash it was given. */
+      async getPluginZip(workspace, version) {
+        const res = await fetch(
+          this.buildUrl(`${TEAM_SETUP}/${seg(workspace)}/plugin/versions/${seg(version)}/zip`),
+          {
+            headers: {
+              Authorization: `Bearer ${this.config.apiKey}`,
+              "X-API-Key": this.config.apiKey,
+              Accept: "application/zip"
+            }
+          }
+        );
+        if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
+        return { bytes: Buffer.from(await res.arrayBuffer()), sha256: res.headers.get("x-content-sha256") };
+      }
+      listMemoryProjects(workspace) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/memory`);
+      }
+      getMemory(workspace, project) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}`);
+      }
+      /** pushMemoryVersion: a stale base throws SystemDoxApiError with status 409,
+       * code SYD-K010 and `body.currentVersion`. */
+      pushMemoryVersion(workspace, project, body) {
+        return this.post(`${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/versions`, body);
+      }
+      getMemoryVersion(workspace, project, version) {
+        return this.getFresh(
+          `${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/versions/${seg(version)}`
+        );
+      }
+      findMissingBlobs(workspace, project, hashes) {
+        return this.post(
+          `${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/blobs/missing`,
+          { hashes }
+        );
+      }
+      uploadBlobs(workspace, project, blobs) {
+        return this.post(`${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/blobs`, { blobs });
+      }
+      readBlobs(workspace, project, hashes) {
+        return this.post(`${TEAM_SETUP}/${seg(workspace)}/memory/${seg(project)}/blobs/read`, { hashes });
+      }
+      listValueAnswers(workspace) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/values`);
+      }
+      lookupValues(workspace, values) {
+        return this.post(`${TEAM_SETUP}/${seg(workspace)}/values`, { values });
+      }
+      answerValues(workspace, answers) {
+        return this.put(`${TEAM_SETUP}/${seg(workspace)}/values`, { answers });
+      }
+      fileMemoryPeople(workspace, people2) {
+        return this.post(`${TEAM_SETUP}/${seg(workspace)}/people`, { people: people2 });
+      }
+      resolvePerson(workspace, personId) {
+        return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}/people/${seg(personId)}`);
+      }
+      invalidateCache(path) {
+        if (path) {
+          this.cache.invalidate(this.buildUrl(path).toString());
+        } else {
+          this.cache.clear();
+        }
+      }
+      buildUrl(path, params) {
+        const base = this.config.apiUrl.replace(/\/+$/, "");
+        const url = new URL(`${base}${path.startsWith("/") ? "" : "/"}${path}`);
+        if (params) {
+          for (const [key, value] of Object.entries(params)) {
+            url.searchParams.set(key, value);
+          }
+        }
+        return url;
+      }
+      async fetchRaw(path, params) {
+        const url = this.buildUrl(path, params);
+        return fetch(url, {
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "X-API-Key": this.config.apiKey,
+            Accept: "application/json"
+          }
+        });
+      }
+    };
+  }
+});
+
+// src/lib/person-values.ts
+function lineOf(text3, start) {
+  let line = 1;
+  for (let i = text3.indexOf("\n"); i !== -1 && i < start; i = text3.indexOf("\n", i + 1)) line++;
+  return line;
+}
+function phoneShape(value) {
+  const groups = value.replace(/^\++/, "").split(/[ -]/);
+  const digits = [...groups.join("")];
+  if (value.startsWith("+")) return digits.length >= 8 && digits.length <= 15 && digits[0] !== "0";
+  if (digits.length < 10 || digits.length > 11) return false;
+  return groups.length === 1 || groups.slice(1).every((g) => GROUP_SIZES.has([...g].length));
+}
+function normalise(kind, value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (kind === PHONE) {
+    if (!(whole(E164).test(v) || whole(NATIONAL).test(v)) || !phoneShape(v)) {
+      throw new Error("not a phone number");
+    }
+    const digits = v.replace(/[ -]/g, "");
+    return digits.startsWith("+") ? digits : NATIONAL_PREFIX + digits.slice(1);
+  }
+  if (kind === EMAIL) {
+    if (!whole(EMAIL_RE).test(v)) throw new Error("not an email address");
+    return v.toLowerCase();
+  }
+  throw new Error(`not a value kind: ${JSON.stringify(kind)}`);
+}
+function findPersonValues(text3) {
+  if (typeof text3 !== "string" || !text3) return [];
+  const skipped = [...text3.matchAll(global(PERSON_TOKEN))].map((m) => [m.index, m.index + m[0].length]);
+  const found = [];
+  const add = (kind, m, normalised) => {
+    const start = m.index;
+    const end = start + m[0].length;
+    if (skipped.some(([s, e]) => s <= start && end <= e)) return;
+    if (found.some((f) => f.start < end && start < f.end)) return;
+    found.push({ kind, value: m[0], normalised, line: lineOf(text3, start), start, end });
+  };
+  for (const m of text3.matchAll(global(EMAIL_RE))) add(EMAIL, m, m[0].toLowerCase());
+  for (const source of [E164, NATIONAL]) {
+    for (const m of text3.matchAll(global(source))) {
+      if (phoneShape(m[0])) add(PHONE, m, normalise(PHONE, m[0]));
+    }
+  }
+  for (const m of text3.matchAll(global(HOME, "i"))) add(HOME_PATH, m, m[0]);
+  return found.sort((a, b) => a.start - b.start);
+}
+function findSecrets(text3) {
+  if (typeof text3 !== "string" || !text3) return [];
+  return [...text3.matchAll(global(KEY_PREFIX))].map((m) => ({ kind: "key-prefix", line: lineOf(text3, m.index) }));
+}
+var PHONE, EMAIL, HOME_PATH, NATIONAL_PREFIX, W, D, WORD_OR, PERSON_ID, PERSON_TOKEN, BEFORE, AFTER, E164, NATIONAL, GROUP_SIZES, ATEXT, EMAIL_RE, HOME_PREFIX, HOME, KEY_PREFIX, global, whole;
+var init_person_values = __esm({
+  "src/lib/person-values.ts"() {
+    "use strict";
+    PHONE = "phone";
+    EMAIL = "email";
+    HOME_PATH = "home-path";
+    NATIONAL_PREFIX = "+44";
+    W = "[\\p{L}\\p{N}_]";
+    D = "\\p{Nd}";
+    WORD_OR = (extra) => `[\\p{L}\\p{N}_${extra}]`;
+    PERSON_ID = "(?:(?:con|ctc)_[0-9A-Za-z]{10,40}|usr_[0-9A-Za-z-]{10,40})";
+    PERSON_TOKEN = `\`${PERSON_ID}\`(?:[ \\t]*\\([^()\\n]*\\))?`;
+    BEFORE = `(?<!${WORD_OR("+.:/\\\\\\-")})(?<!${D}[ -])`;
+    AFTER = `(?!${WORD_OR(":/\\\\")}|\\.${D}|[ -]?${D}|-${W})`;
+    E164 = `${BEFORE}\\+${D}+(?:[ -]${D}+)*${AFTER}`;
+    NATIONAL = `${BEFORE}0${D}*(?:[ -]${D}+)*${AFTER}`;
+    GROUP_SIZES = /* @__PURE__ */ new Set([2, 3, 4, 5, 6]);
+    ATEXT = "[A-Za-z0-9!#$%&'*+/=?^_{|}~\\-]";
+    EMAIL_RE = "(?<![A-Za-z0-9!#$%&*+/=?^_{|}~.@\\-])[A-Za-z0-9_]" + ATEXT + "*(?:\\." + ATEXT + "+)*@(?:[A-Za-z0-9](?:[A-Za-z0-9\\-]{0,61}[A-Za-z0-9])?\\.)+[A-Za-z]{2,63}(?![A-Za-z0-9\\-]|\\.[A-Za-z0-9])";
+    HOME_PREFIX = "(?:[A-Za-z]:\\\\+Users\\\\+|[A-Za-z]:/+Users/+|/Users/|/home/)";
+    HOME = `(?<!${WORD_OR(".~:/\\\\$}\\-")})${HOME_PREFIX}[^\\\\/\\s"'\`<>|:*?]+`;
+    KEY_PREFIX = `(?<!${W})(?:pweb_[a-z]+_key_|sk-ant-|sk_live_|rk_live_|github_pat_|gh[pousr]_|sntrys_|xox[baprs]-)[A-Za-z0-9_\\-]{4,}`;
+    global = (source, flags = "") => new RegExp(source, `gu${flags}`);
+    whole = (source, flags = "") => new RegExp(`^(?:${source})$`, `u${flags}`);
+  }
+});
+
+// src/lib/memory-sync.ts
+import { createHash } from "crypto";
+function sha256(text3) {
+  return createHash("sha256").update(text3, "utf8").digest("hex");
+}
+function isFilePath(path) {
+  return path.length <= 512 && FILE_PATH_RE.test(path) && !path.split("/").some((s) => s === "." || s === "..");
+}
+function isConflictCopy(path) {
+  return CONFLICT_COPY_RE.test(path.split("/").pop() ?? path);
+}
+function readFrontmatter(text3) {
+  const m = BLOCK_RE.exec(text3);
+  if (!m) return void 0;
+  const front = { shareFalse: false };
+  for (const line of m[1].split(/\r?\n/)) {
+    const kv = /^([A-Za-z_][\w-]*)[ \t]*:[ \t]*(.*?)[ \t]*$/.exec(line);
+    if (!kv) continue;
+    const raw = kv[2].replace(/[ \t]+#.*$/, "");
+    const quoted = /^(["'])(.*)\1$/.exec(raw);
+    const value = quoted ? quoted[2] : raw;
+    if (kv[1] === "type") front.type = value.trim().toLowerCase();
+    if (kv[1] === "share") front.shareFalse = quoted ? value.trim().toLowerCase() === "false" : YAML_FALSE.has(value);
+  }
+  return front;
+}
+function isShareable(path, text3) {
+  if (isConflictCopy(path) || !path.endsWith(".md")) return false;
+  const front = readFrontmatter(text3);
+  if (front?.shareFalse) return false;
+  if (path === INDEX_FILE) return true;
+  return !!front && SHAREABLE_TYPES.includes(front.type ?? "");
+}
+function addShareFalse(text3) {
+  const eol = text3.includes("\r\n") ? "\r\n" : "\n";
+  const m = BLOCK_RE.exec(text3);
+  if (!m) return `---${eol}share: false${eol}---${eol}${text3}`;
+  const lines = m[1].split(/\r?\n/).filter((l) => !/^share[ \t]*:/.test(l));
+  lines.push("share: false");
+  const closing = m[0].slice(m[0].lastIndexOf("---"));
+  return `---${eol}${lines.join(eol)}${eol}${closing}${text3.slice(m[0].length)}`;
+}
+function localDate(now) {
+  const p = (n) => String(n).padStart(2, "0");
+  return `${now.getFullYear()}-${p(now.getMonth() + 1)}-${p(now.getDate())}`;
+}
+function conflictCopyName(path, date, taken) {
+  const stem = path.replace(/\.md$/, "");
+  for (let n = 1; ; n++) {
+    const name = `${stem}.local-${date}${n === 1 ? "" : `-${n}`}.md`;
+    if (!taken.has(name.toLowerCase())) return name;
+  }
+}
+function decide(path, base, team, local) {
+  if (team === local) return "unchanged";
+  if (team === base) return local === void 0 ? "delete-team" : "local";
+  if (local === base) return team === void 0 ? "delete-local" : "team";
+  if (path === INDEX_FILE && team !== void 0 && local !== void 0) return "index";
+  if (team === void 0) return "local";
+  if (local === void 0) return "team";
+  return "conflict";
+}
+function decideAll(input) {
+  const localHashes = Object.fromEntries(Object.entries(input.local).map(([p, t]) => [p, sha256(t)]));
+  const paths = /* @__PURE__ */ new Set([...Object.keys(input.base), ...Object.keys(input.team), ...Object.keys(localHashes)]);
+  const rows = {};
+  const needed = /* @__PURE__ */ new Set();
+  for (const path of [...paths].sort()) {
+    if (input.excluded.has(path)) continue;
+    const row = decide(path, input.base[path], input.team[path], localHashes[path]);
+    rows[path] = row;
+    if (row === "team" || row === "conflict" || row === "index") needed.add(input.team[path]);
+    if (row === "index" && input.base[path]) needed.add(input.base[path]);
+  }
+  return { rows, needed: [...needed] };
+}
+function planMerge(input, rows, texts) {
+  const plan = {
+    manifest: {},
+    upload: {},
+    writes: {},
+    deletes: [],
+    pulled: [],
+    pushed: [],
+    deletedHere: [],
+    deletedFromTeam: [],
+    conflicts: [],
+    indexTeamLines: []
+  };
+  const taken = new Set(input.taken);
+  const teamText = (path) => {
+    const text3 = texts[input.team[path]];
+    if (text3 === void 0) throw new Error(`the team's ${path} could not be read`);
+    return text3;
+  };
+  for (const path of input.excluded) if (input.team[path]) plan.manifest[path] = input.team[path];
+  for (const [path, row] of Object.entries(rows)) {
+    const team = input.team[path];
+    const local = input.local[path];
+    switch (row) {
+      case "unchanged":
+        if (team) plan.manifest[path] = team;
+        break;
+      case "local":
+        plan.manifest[path] = sha256(local);
+        plan.upload[path] = local;
+        plan.pushed.push(path);
+        break;
+      case "delete-team":
+        plan.deletedFromTeam.push(path);
+        break;
+      case "team":
+        plan.manifest[path] = team;
+        plan.writes[path] = teamText(path);
+        plan.pulled.push(path);
+        break;
+      case "delete-local":
+        plan.deletes.push(path);
+        plan.deletedHere.push(path);
+        break;
+      case "conflict": {
+        const copy = conflictCopyName(path, input.date, taken);
+        taken.add(copy.toLowerCase());
+        plan.manifest[path] = team;
+        plan.writes[path] = teamText(path);
+        plan.writes[copy] = local;
+        plan.conflicts.push({ path, copy });
+        break;
+      }
+      case "index": {
+        const base = input.base[path] ? texts[input.base[path]] : void 0;
+        const merged = mergeIndex(base, teamText(path), local);
+        const hash = sha256(merged.text);
+        plan.manifest[path] = hash;
+        if (merged.text !== local) {
+          plan.writes[path] = merged.text;
+          plan.pulled.push(path);
+        }
+        if (hash !== team) {
+          plan.upload[path] = merged.text;
+          plan.pushed.push(path);
+        }
+        plan.indexTeamLines.push(...merged.teamLines);
+        break;
+      }
+    }
+  }
+  return plan;
+}
+function entries(lines) {
+  const seen = /* @__PURE__ */ new Map();
+  return lines.map((line) => {
+    const link = LINK_RE.exec(line);
+    const id = link ? `link:${link[1]}` : `text:${line}`;
+    const n = seen.get(id) ?? 0;
+    seen.set(id, n + 1);
+    return { key: n ? `${id}#${n}` : id, line };
+  });
+}
+function mergeIndex(base, team, local) {
+  const eol = local.includes("\r\n") ? "\r\n" : "\n";
+  const b = new Map(entries(base === void 0 ? [] : splitLines(base)).map((e) => [e.key, e.line]));
+  const teamEntries = entries(splitLines(team));
+  const t = new Map(teamEntries.map((e) => [e.key, e.line]));
+  const localEntries = entries(splitLines(local));
+  const result = [];
+  const teamLines = [];
+  for (const e of localEntries) {
+    const was = b.get(e.key);
+    const theirs = t.get(e.key);
+    if (theirs === e.line || theirs === was) result.push(e);
+    else if (e.line === was) {
+      if (theirs !== void 0) result.push({ key: e.key, line: theirs });
+    } else {
+      result.push(e);
+      if (theirs !== void 0) teamLines.push(theirs);
+    }
+  }
+  const baseEntries = entries(base === void 0 ? [] : splitLines(base));
+  const localKeys = new Set(localEntries.map((e) => e.key));
+  const replacedHere = /* @__PURE__ */ new Map();
+  baseEntries.forEach((e, i) => {
+    if (e.key.startsWith("text:") && !t.has(e.key) && !localKeys.has(e.key)) {
+      replacedHere.set(e.key, i ? baseEntries[i - 1].key : "");
+    }
+  });
+  const inResult = (key) => result.findIndex((e) => e.key === key);
+  teamEntries.forEach((e, i) => {
+    if (inResult(e.key) !== -1) return;
+    const was = b.get(e.key);
+    const before = i ? teamEntries[i - 1].key : "";
+    const both = e.key.startsWith("text:") && [...replacedHere].find(([, prev]) => prev === before);
+    if (was === void 0 && both) {
+      replacedHere.delete(both[0]);
+      teamLines.push(e.line);
+    } else if (was === void 0) {
+      let at = -1;
+      for (let j = i - 1; j >= 0 && at === -1; j--) at = inResult(teamEntries[j].key);
+      result.splice(at + 1, 0, e);
+    } else if (e.line !== was) {
+      teamLines.push(e.line);
+    }
+  });
+  return { text: result.map((e) => e.line).join(eol), teamLines };
+}
+function collectValues(files) {
+  const groups = /* @__PURE__ */ new Map();
+  const homePaths = [];
+  const findings = {};
+  for (const path of Object.keys(files).sort()) {
+    const found = findPersonValues(files[path]);
+    findings[path] = found;
+    for (const f of found) {
+      if (f.kind === HOME_PATH) {
+        if (!homePaths.includes(path)) homePaths.push(path);
+        continue;
+      }
+      const key = groupKey(f.kind, f.normalised);
+      const group = groups.get(key);
+      if (group) {
+        if (!group.files.includes(path)) group.files.push(path);
+      } else {
+        groups.set(key, {
+          kind: f.kind,
+          value: f.value,
+          normalised: f.normalised,
+          files: [path],
+          first: { path, line: f.line, text: splitLines(files[path])[f.line - 1].trim() }
+        });
+      }
+    }
+  }
+  return { groups: [...groups.values()], homePaths, findings };
+}
+function personToken(personId, label) {
+  return label ? `\`${personId}\` (${label})` : `\`${personId}\``;
+}
+function rewriteValues(text3, findings, replacement) {
+  let out = "";
+  let last = 0;
+  for (const f of [...findings].sort((a, b) => a.start - b.start)) {
+    const to = replacement(f);
+    if (to === void 0) continue;
+    out += text3.slice(last, f.start) + to;
+    last = f.end;
+  }
+  return out + text3.slice(last);
+}
+function lineDiff(before, after) {
+  const a = splitLines(before);
+  const b = splitLines(after);
+  const out = [];
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    if (a[i] === b[i]) continue;
+    if (a[i] !== void 0) out.push(`- ${a[i]}`);
+    if (b[i] !== void 0) out.push(`+ ${b[i]}`);
+  }
+  return out;
+}
+var INDEX_FILE, SHAREABLE_TYPES, FILE_PATH_RE, CONFLICT_COPY_RE, BLOCK_RE, YAML_FALSE, LINK_RE, splitLines, groupKey;
+var init_memory_sync = __esm({
+  "src/lib/memory-sync.ts"() {
+    "use strict";
+    init_person_values();
+    INDEX_FILE = "MEMORY.md";
+    SHAREABLE_TYPES = ["feedback", "project", "reference"];
+    FILE_PATH_RE = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/;
+    CONFLICT_COPY_RE = /\.local-\d{4}-\d{2}-\d{2}(?:-\d+)?\.md$/;
+    BLOCK_RE = /^---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/;
+    YAML_FALSE = /* @__PURE__ */ new Set(["false", "False", "FALSE", "no", "No", "NO", "off", "Off", "OFF"]);
+    LINK_RE = /\]\(\s*<?([^)\s>]+)>?(?:\s+["'(][^)]*)?\)/;
+    splitLines = (text3) => text3.split(/\r?\n/);
+    groupKey = (kind, normalised) => `${kind}:${normalised}`;
+  }
+});
+
+// src/sync-memory.ts
+var sync_memory_exports = {};
+__export(sync_memory_exports, {
+  SYNC_MEMORY_COMMAND: () => SYNC_MEMORY_COMMAND,
+  SYNC_MEMORY_USAGE: () => SYNC_MEMORY_USAGE,
+  parseSyncMemoryArgs: () => parseSyncMemoryArgs,
+  runSyncMemory: () => runSyncMemory,
+  syncMemory: () => syncMemory
+});
+import { existsSync } from "fs";
+import { mkdir as mkdir2, readdir, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2, join as join2, resolve } from "path";
+function refusal(e) {
+  if (!(e instanceof Error)) return {};
+  const { status, code } = e;
+  return { status: typeof status === "number" ? status : void 0, code: typeof code === "string" ? code : void 0 };
+}
+function parseSyncMemoryArgs(argv) {
+  const args2 = { dryRun: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--dry-run") args2.dryRun = true;
+    else if (a === "--project" || a === "--dir" || a === "--import") {
+      const value = argv[++i];
+      if (!value || value.startsWith("--")) throw new SyncFailed(`${a} needs a value
+${SYNC_MEMORY_USAGE}`);
+      if (a === "--project") {
+        if (!isWorkspace(value)) throw new SyncFailed(`${value} is not a project name (lower case letters, digits and -)`);
+        args2.project = value;
+      } else if (a === "--dir") args2.dir = value;
+      else args2.importDir = value;
+    } else throw new SyncFailed(`Unexpected argument ${a}
+${SYNC_MEMORY_USAGE}`);
+  }
+  return args2;
+}
+async function readFolder(root) {
+  const files = {};
+  const names = /* @__PURE__ */ new Set();
+  async function walk2(dir, prefix) {
+    for (const e of await readdir(dir, { withFileTypes: true })) {
+      if (e.name.startsWith(".")) continue;
+      const rel = prefix ? `${prefix}/${e.name}` : e.name;
+      if (e.isDirectory()) await walk2(join2(dir, e.name), rel);
+      else if (e.isFile()) {
+        names.add(rel.toLowerCase());
+        if (e.name.endsWith(".md")) files[rel] = await readFile2(join2(dir, e.name), "utf8");
+      }
+    }
+  }
+  if (existsSync(root)) await walk2(root, "");
+  return { files, names };
+}
+async function pullTeam(client, ws, project) {
+  try {
+    const latest = await client.getMemory(ws, project);
+    return {
+      version: latest.version,
+      manifest: Object.fromEntries(Object.entries(latest.files).map(([p, f]) => [p, f.sha256])),
+      exists: true
+    };
+  } catch (e) {
+    if (refusal(e).status === 404) return { version: 0, manifest: {}, exists: false };
+    throw e;
+  }
+}
+async function readTexts(client, ws, project, hashes) {
+  const texts = {};
+  const one = async (batch) => {
+    let left = batch;
+    while (left.length) {
+      const got = await client.readBlobs(ws, project, left);
+      for (const b of got.blobs) texts[b.sha256] = b.content;
+      if (!got.blobs.length) break;
+      left = got.remaining;
+    }
+  };
+  for (let i = 0; i < hashes.length; i += 1e3) {
+    const batch = hashes.slice(i, i + 1e3);
+    try {
+      await one(batch);
+    } catch (e) {
+      if (!(refusal(e).status === 404)) throw e;
+      for (const h of batch) {
+        try {
+          await one([h]);
+        } catch (err) {
+          if (!(refusal(err).status === 404)) throw err;
+        }
+      }
+    }
+  }
+  return texts;
+}
+function labelProblem(label) {
+  if (!label) return "a label is needed";
+  if (label.length > 60) return "a label is at most 60 characters";
+  if (findPersonValues(label).length) return "a label is a role, never a phone number, an email address or a path";
+  return void 0;
+}
+async function askLabel(ask, out, question, optional) {
+  for (; ; ) {
+    const label = (await ask(question)).trim();
+    if (optional && !label) return void 0;
+    const problem = labelProblem(label);
+    if (!problem) return label;
+    out(`  ${problem}.`);
+  }
+}
+async function people(opts, ws, files, report, hint) {
+  const { client, out, ask, dryRun } = opts;
+  const terminal = !!ask && !dryRun;
+  const held = /* @__PURE__ */ new Set();
+  const leftOut = /* @__PURE__ */ new Set();
+  const current = { ...files };
+  for (const [path, text3] of Object.entries(current)) {
+    const secret = findSecrets(text3)[0];
+    if (secret) {
+      held.add(path);
+      report.skip(path, `a secret (${secret.kind}) on line ${secret.line}: remove it, then sync again`);
+    }
+  }
+  const { groups, findings } = collectValues(current);
+  const answers = /* @__PURE__ */ new Map();
+  for (let i = 0; i < groups.length; i += 500) {
+    const batch = groups.slice(i, i + 500);
+    const got = await client.lookupValues(ws, batch.map((g) => ({ kind: g.kind, value: g.value })));
+    batch.forEach((g, j) => {
+      const a = got.answers[j];
+      if (a && a.answer !== "unanswered") answers.set(groupKey(g.kind, g.normalised), a);
+    });
+  }
+  const vaultDown = /* @__PURE__ */ new Set();
+  if (terminal) {
+    const filed = [];
+    for (const g of groups) {
+      const key = groupKey(g.kind, g.normalised);
+      if (answers.has(key)) continue;
+      let choices = ["m", "p", "o", "x", "s"];
+      for (; ; ) {
+        const question = [
+          `${g.value} (${g.kind}) is in ${g.files.length} file${g.files.length === 1 ? "" : "s"}. First line it appears on, in ${g.first.path}:`,
+          `  ${g.first.text}`,
+          [
+            choices.includes("m") && "[m] a member's contact",
+            "[p] someone else",
+            "[o] ours, not a person",
+            "[x] leave these files out",
+            "[s] skip for now"
+          ].filter(Boolean).join("  "),
+          `Answer (${choices.join("/")}): `
+        ].join("\n");
+        const answer = (await ask(question)).trim().toLowerCase();
+        if (!choices.includes(answer)) continue;
+        if (answer === "s") break;
+        if (answer === "x") {
+          for (const path of g.files) {
+            if (leftOut.has(path)) continue;
+            current[path] = addShareFalse(current[path]);
+            await writeFile2(toPath(opts.dir, path), current[path], "utf8");
+            leftOut.add(path);
+          }
+          report.people.push({ kind: g.kind, answer: "left out (share: false)", files: g.files.length });
+          break;
+        }
+        if (answer === "p") {
+          const label2 = await askLabel(ask, out, "Their role, as a label (e.g. reseller, sales; never a name): ", false);
+          let entry = filed.length ? await (async () => {
+            const list = filed.map((f, i) => `  ${i + 1}. ${f.label}: ${f.groups.map((x) => x.value).join(", ")}`);
+            for (; ; ) {
+              const same = (await ask(["The same person as one filed above?", ...list, "Number, or Enter for a new person: "].join("\n"))).trim();
+              if (!same) return void 0;
+              const n = Number(same);
+              if (Number.isInteger(n) && n >= 1 && n <= filed.length && filed[n - 1].groups.length < 4) return filed[n - 1];
+            }
+          })() : void 0;
+          if (!entry) {
+            entry = { groups: [], label: label2 };
+            filed.push(entry);
+          }
+          entry.groups.push(g);
+          break;
+        }
+        const label = answer === "m" ? await askLabel(ask, out, "A role label for it (e.g. owner, business mobile), or Enter for none: ", true) : void 0;
+        let result;
+        try {
+          result = await client.answerValues(ws, [
+            { kind: g.kind, value: g.value, answer: answer === "m" ? "member" : "ours", ...label ? { label } : {} }
+          ]);
+        } catch (e) {
+          if (refusal(e).code === "SYD-K019") {
+            vaultDown.add(key);
+            out("  The vault did not answer (SYD-K019): the files holding it wait for the next sync.");
+            break;
+          }
+          throw e;
+        }
+        if (result.stored[0]) {
+          answers.set(key, result.stored[0]);
+          report.people.push({ kind: g.kind, answer: ANSWER_WORDS[result.stored[0].answer], label: result.stored[0].label, personId: result.stored[0].personId });
+          break;
+        }
+        const refused = result.refused[0];
+        if (refused?.code === "SYD-K021") {
+          out(`  ${refused.detail}. Add them in Staff first, or answer p to file them.`);
+          choices = choices.filter((c) => c !== "m");
+        } else if (refused) out(`  ${refused.detail}`);
+      }
+    }
+    for (let i = 0; i < filed.length; i += 50) {
+      const batch = filed.slice(i, i + 50);
+      let result;
+      try {
+        result = await client.fileMemoryPeople(
+          ws,
+          batch.map((f) => ({ values: f.groups.map((g) => ({ kind: g.kind, value: g.value })), label: f.label }))
+        );
+      } catch (e) {
+        if (refusal(e).code === "SYD-K019") {
+          out("Contacts did not answer (SYD-K019): the files holding those values wait for the next sync.");
+          batch.forEach((f) => f.groups.forEach((g) => vaultDown.add(groupKey(g.kind, g.normalised))));
+          continue;
+        }
+        throw e;
+      }
+      for (const stored of result.stored) {
+        let key;
+        try {
+          key = groupKey(stored.kind, normalise(stored.kind, stored.value));
+        } catch {
+          continue;
+        }
+        answers.set(key, stored);
+      }
+      for (const r of result.refused) {
+        out(`  ${batch[r.index]?.label ?? ""}: ${r.detail}`);
+      }
+      for (const f of batch) {
+        const a = answers.get(groupKey(f.groups[0].kind, f.groups[0].normalised));
+        if (a?.answer === "person") {
+          for (const g of f.groups) report.people.push({ kind: g.kind, answer: ANSWER_WORDS.person, label: a.label, personId: a.personId });
+        }
+      }
+    }
+  }
+  const rewritten = {};
+  for (const [path, text3] of Object.entries(current)) {
+    if (leftOut.has(path) || held.has(path)) continue;
+    const next = rewriteValues(text3, findings[path] ?? [], (f) => {
+      if (f.kind === HOME_PATH) return "~";
+      const a = answers.get(groupKey(f.kind, f.normalised));
+      return a && (a.answer === "member" || a.answer === "person") && a.personId ? personToken(a.personId, a.label) : void 0;
+    });
+    if (next !== text3) rewritten[path] = next;
+  }
+  const paths = Object.keys(rewritten).sort();
+  if (paths.length && terminal) {
+    out("", "The rewrite:");
+    for (const path of paths) out(path, ...lineDiff(current[path], rewritten[path]).map((l) => `  ${l}`));
+    const yes = /^y(es)?$/i.test((await ask(`Rewrite ${paths.length} file${paths.length === 1 ? "" : "s"} as shown? [y/N] `)).trim());
+    if (yes) {
+      for (const path of paths) {
+        await writeFile2(toPath(opts.dir, path), rewritten[path], "utf8");
+        current[path] = rewritten[path];
+      }
+    }
+  }
+  for (const [path, text3] of Object.entries(current)) {
+    if (leftOut.has(path) || held.has(path)) continue;
+    const pending = findPersonValues(text3).filter((f) => {
+      if (f.kind === HOME_PATH) return true;
+      return answers.get(groupKey(f.kind, f.normalised))?.answer !== "ours";
+    });
+    if (!pending.length) continue;
+    held.add(path);
+    const keys = pending.filter((f) => f.kind !== HOME_PATH).map((f) => groupKey(f.kind, f.normalised));
+    if (keys.some((k) => vaultDown.has(k))) {
+      report.skip(path, "the vault did not answer (SYD-K019) for a value in it; it syncs once the value is filed");
+    } else if (keys.some((k) => !answers.has(k))) {
+      report.skip(path, `it holds a value nobody has answered for: run \`${hint}\` in a terminal`);
+    } else {
+      report.skip(path, `it holds a value to rewrite as its identifier or ~: run \`${hint}\` in a terminal`);
+    }
+  }
+  for (const g of groups) {
+    const key = groupKey(g.kind, g.normalised);
+    if (!answers.has(key) && g.files.some((p) => !leftOut.has(p))) {
+      report.toAnswer.set(g.kind, (report.toAnswer.get(g.kind) ?? 0) + 1);
+    }
+  }
+  return { files: current, held, leftOut };
+}
+async function applyPlan(dir, plan) {
+  for (const [path, text3] of Object.entries(plan.writes)) {
+    const full = toPath(dir, path);
+    await mkdir2(dirname2(full), { recursive: true });
+    await writeFile2(full, text3, "utf8");
+  }
+  for (const path of plan.deletes) await rm2(toPath(dir, path), { force: true });
+}
+async function upload(client, ws, project, plan, team, report) {
+  const byHash = /* @__PURE__ */ new Map();
+  for (const path of Object.keys(plan.upload)) {
+    const h = plan.manifest[path];
+    byHash.set(h, [...byHash.get(h) ?? [], path]);
+  }
+  const hashes = [...byHash.keys()];
+  const missing = [];
+  for (let i = 0; i < hashes.length; i += 1e4) {
+    missing.push(...(await client.findMissingBlobs(ws, project, hashes.slice(i, i + 1e4))).missing);
+  }
+  const blobs = missing.map((h) => ({ sha256: h, content: plan.upload[byHash.get(h)[0]] }));
+  let batch = [];
+  let bytes = 0;
+  const send = async () => {
+    if (!batch.length) return;
+    const result = await client.uploadBlobs(ws, project, batch);
+    for (const r of result.refused) {
+      for (const path of byHash.get(r.sha256) ?? []) {
+        if (team[path]) plan.manifest[path] = team[path];
+        else delete plan.manifest[path];
+        plan.pushed = plan.pushed.filter((p) => p !== path);
+        report.pushed.delete(path);
+        report.skip(path, `refused by SystemDox, ${r.detail.startsWith(r.code) ? r.detail : `${r.code}: ${r.detail}`}`);
+      }
+    }
+    batch = [];
+    bytes = 0;
+  };
+  for (const blob of blobs) {
+    const size = Buffer.byteLength(blob.content, "utf8");
+    if (batch.length === 100 || batch.length && bytes + size > 5 * 1024 * 1024 - 64 * 1024) await send();
+    batch.push(blob);
+    bytes += size;
+  }
+  await send();
+}
+async function keyFromEnvironment(env) {
+  if (env.SYSTEMDOX_API_KEY) return env.SYSTEMDOX_API_KEY;
+  const entries2 = Object.entries(await readCredentials()).filter(([, v]) => typeof v?.apiKey === "string" && v.apiKey);
+  if (entries2.length === 1) return entries2[0][1].apiKey;
+  if (entries2.length > 1) {
+    throw new SyncFailed(
+      `~/.claude/systemdox/credentials.json holds keys for ${entries2.map(([w]) => w).join(", ")}: set SYSTEMDOX_API_KEY to the key of the workspace to sync.`
+    );
+  }
+  throw new SyncFailed("No SystemDox key. Set SYSTEMDOX_API_KEY, or run npx -y @systemdox/mcp-server setup, then run this again.");
+}
+async function syncMemory(opts) {
+  const { client, out } = opts;
+  const now = opts.now?.() ?? /* @__PURE__ */ new Date();
+  try {
+    const own = await client.getOwnTeamSetup();
+    const ws = own.workspace;
+    const project = opts.project ?? (own.memory.length === 1 ? own.memory[0].project : void 0);
+    if (!project) {
+      throw new SyncFailed(
+        own.memory.length ? `${ws} has ${own.memory.length} team memories (${own.memory.map((m) => m.project).join(", ")}): name one with --project.` : `${ws} has no team memory yet: name the project to start with --project.`
+      );
+    }
+    const dir = resolve(opts.dir ?? join2(workspaceDir(ws), "memory", project));
+    const run3 = { ...opts, dir };
+    const hint = [SYNC_MEMORY_COMMAND, `--project ${project}`, opts.dir ? `--dir "${opts.dir}"` : ""].filter(Boolean).join(" ");
+    const report = new Report();
+    const date = localDate(now);
+    const stored = (await readState(ws)).memory?.[project];
+    let team = await pullTeam(client, ws, project);
+    let base = stored ? { version: stored.version, manifest: stored.manifest, exists: true } : { version: 0, manifest: {}, exists: false };
+    const folder = await readFolder(dir);
+    const shared = {};
+    const notShared = /* @__PURE__ */ new Set();
+    for (const [path, text3] of Object.entries(folder.files)) {
+      if (!isShareable(path, text3)) notShared.add(path);
+      else if (!isFilePath(path)) {
+        notShared.add(path);
+        report.skip(path, "its name has characters a team memory path cannot hold (letters, digits, '.', '_', '-')");
+      } else shared[path] = text3;
+    }
+    const importWrites = {};
+    if (opts.importDir) {
+      const other = await readFolder(resolve(opts.importDir));
+      const taken = new Set(folder.names);
+      for (const [path, text3] of Object.entries(other.files).sort(([a], [b]) => a.localeCompare(b))) {
+        if (!isShareable(path, text3) || !isFilePath(path)) continue;
+        const here = folder.files[path];
+        if (here === void 0) {
+          shared[path] = text3;
+          importWrites[path] = text3;
+          taken.add(path.toLowerCase());
+        } else if (here !== text3) {
+          const copy = conflictCopyName(path, date, taken);
+          taken.add(copy.toLowerCase());
+          importWrites[copy] = text3;
+          report.conflicts.push(`${path}: this folder's text; the imported one is beside it as ${copy}`);
+        }
+      }
+      folder.names = taken;
+      if (!opts.dryRun) {
+        for (const [path, text3] of Object.entries(importWrites)) {
+          const full = toPath(dir, path);
+          await mkdir2(dirname2(full), { recursive: true });
+          await writeFile2(full, text3, "utf8");
+        }
+      }
+    }
+    const found = await people(run3, ws, shared, report, hint);
+    for (const path of found.leftOut) {
+      delete found.files[path];
+      notShared.add(path);
+    }
+    const excluded = /* @__PURE__ */ new Set([...found.held, ...notShared]);
+    for (const path of found.held) delete found.files[path];
+    for (let attempt = 1; ; attempt++) {
+      const input = { base: base.manifest, team: team.manifest, local: found.files, excluded, taken: folder.names, date };
+      const { rows, needed } = decideAll(input);
+      const texts = needed.length ? await readTexts(client, ws, project, needed) : {};
+      const plan = planMerge(input, rows, texts);
+      report.add(plan);
+      if (opts.dryRun) {
+        const skipped = report.skipped.size;
+        out(
+          ...report.lines(
+            `Dry run of ${ws}/${project} against version ${team.version}: would pull ${report.pulled.size}, push ${report.pushed.size} and delete ${report.deletedHere.size + report.deletedFromTeam.size}; ${report.conflicts.length} conflicts, ${skipped} skipped. Nothing was asked, written or sent.`,
+            true
+          )
+        );
+        return 0;
+      }
+      await applyPlan(dir, plan);
+      let version = team.version;
+      if (!sameManifest(plan.manifest, team.manifest)) {
+        await upload(client, ws, project, plan, team.manifest, report);
+      }
+      if (!sameManifest(plan.manifest, team.manifest)) {
+        try {
+          version = (await client.pushMemoryVersion(ws, project, { baseVersion: team.version, manifest: plan.manifest })).version;
+        } catch (e) {
+          if (!(refusal(e).status === 409 && refusal(e).code === "SYD-K010")) throw e;
+          if (attempt === 2) {
+            out(
+              ...report.lines(
+                `Not pushed: ${ws}/${project} moved on twice while this sync merged. Your folder holds the merge; run sync-memory again.`,
+                false
+              )
+            );
+            return 2;
+          }
+          base = team;
+          for (const p of plan.pushed) report.pushed.delete(p);
+          const again = await readFolder(dir);
+          folder.names = again.names;
+          found.files = {};
+          for (const [path, text3] of Object.entries(again.files)) {
+            if (excluded.has(path) || !isShareable(path, text3) || !isFilePath(path)) continue;
+            found.files[path] = text3;
+          }
+          team = await pullTeam(client, ws, project);
+          continue;
+        }
+      }
+      await updateState(ws, (state) => {
+        state.memory = { ...state.memory, [project]: { version, manifest: plan.manifest } };
+      });
+      out(
+        ...report.lines(
+          `Synced ${ws}/${project} at version ${version}: ${report.pulled.size} pulled, ${report.pushed.size} pushed, ${report.deletedHere.size + report.deletedFromTeam.size} deleted, ${report.conflicts.length} conflicts, ${report.skipped.size} skipped.`,
+          false
+        )
+      );
+      return 0;
+    }
+  } catch (e) {
+    out(e.message);
+    return 1;
+  }
+}
+async function runSyncMemory(argv, io, env = process.env) {
+  let args2;
+  let client = io.client;
+  try {
+    args2 = parseSyncMemoryArgs(argv);
+    if (!client) {
+      const apiUrl = apiUrlFrom(env);
+      const apiKey = await keyFromEnvironment(env);
+      client = new SystemDoxApiClient({ apiKey, apiUrl, cacheTtlMs: 0, defaultOrg: void 0 });
+    }
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  return syncMemory({ ...args2, client, out: (...lines) => lines.forEach((l) => io.out(l)), ask: io.ask, now: io.now });
+}
+var SYNC_MEMORY_USAGE, SYNC_MEMORY_COMMAND, SyncFailed, toPath, Report, ANSWER_WORDS, sameManifest;
+var init_sync_memory = __esm({
+  "src/sync-memory.ts"() {
+    "use strict";
+    init_api_client();
+    init_memory_sync();
+    init_person_values();
+    init_team_setup_files();
+    SYNC_MEMORY_USAGE = "Usage: systemdox-mcp-server sync-memory [--project <name>] [--dir <folder>] [--import <folder>] [--dry-run]";
+    SYNC_MEMORY_COMMAND = "npx -y @systemdox/mcp-server sync-memory";
+    SyncFailed = class extends Error {
+    };
+    toPath = (root, rel) => join2(root, ...rel.split("/"));
+    Report = class {
+      pulled = /* @__PURE__ */ new Set();
+      pushed = /* @__PURE__ */ new Set();
+      deletedHere = /* @__PURE__ */ new Set();
+      deletedFromTeam = /* @__PURE__ */ new Set();
+      conflicts = [];
+      skipped = /* @__PURE__ */ new Map();
+      people = [];
+      toAnswer = /* @__PURE__ */ new Map();
+      add(plan) {
+        plan.pulled.forEach((p) => this.pulled.add(p));
+        plan.pushed.forEach((p) => this.pushed.add(p));
+        plan.deletedHere.forEach((p) => this.deletedHere.add(p));
+        plan.deletedFromTeam.forEach((p) => this.deletedFromTeam.add(p));
+        for (const c of plan.conflicts) this.conflicts.push(`${c.path}: the team's text; yours is beside it as ${c.copy}`);
+        for (const line of plan.indexTeamLines) this.conflicts.push(`${INDEX_FILE}: your line was kept; the team's was: ${line}`);
+      }
+      skip(path, reason) {
+        if (!this.skipped.has(path)) this.skipped.set(path, reason);
+      }
+      lines(summary, dryRun) {
+        const out = [summary];
+        const section = (title, items) => {
+          if (items.length) out.push("", `${title}:`, ...items.map((i) => `- ${i}`));
+        };
+        const sorted = (s) => [...s].sort();
+        section(dryRun ? "Would pull" : "Pulled", sorted(this.pulled));
+        section(dryRun ? "Would push" : "Pushed", sorted(this.pushed));
+        section(dryRun ? "Would delete" : "Deleted", [
+          ...sorted(this.deletedHere).map((p) => `${p} (here: the team deleted it)`),
+          ...sorted(this.deletedFromTeam).map((p) => `${p} (from the team: you deleted it)`)
+        ]);
+        section("Conflicts", this.conflicts);
+        section(
+          "Skipped",
+          [...this.skipped.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([p, why]) => `${p}: ${why}`)
+        );
+        section(
+          "People",
+          this.people.map(
+            (a) => [a.kind, a.answer, a.label, a.personId && `\`${a.personId}\``, a.files !== void 0 && `${a.files} files`].filter(Boolean).join(", ")
+          )
+        );
+        if (this.toAnswer.size) {
+          out.push(
+            "",
+            `Values still to answer: ${[...this.toAnswer.entries()].map(([kind, n]) => `${n} ${kind}`).join(", ")}.`
+          );
+        }
+        return out;
+      }
+    };
+    ANSWER_WORDS = {
+      member: "a member's contact",
+      person: "someone else",
+      ours: "ours, not a person"
+    };
+    sameManifest = (a, b) => Object.keys(a).length === Object.keys(b).length && Object.entries(a).every(([p, h]) => b[p] === h);
+  }
+});
+
+// src/setup-team.ts
+var setup_team_exports = {};
+__export(setup_team_exports, {
+  HEADERS_HELPER: () => HEADERS_HELPER,
+  SETUP_USAGE: () => SETUP_USAGE,
+  claudeCodeVersion: () => claudeCodeVersion,
+  importBlock: () => importBlock,
+  parseSetupArgs: () => parseSetupArgs,
+  runTeamSetup: () => runTeamSetup,
+  runTeamSetupCommand: () => runTeamSetupCommand,
+  setJsonMember: () => setJsonMember,
+  withImportBlock: () => withImportBlock
+});
+import { execFile as execFile2 } from "child_process";
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync2 } from "fs";
+import { mkdir as mkdir3, readdir as readdir2, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, join as join3, resolve as resolve2 } from "path";
+import { promisify as promisify2 } from "util";
+function parseSetupArgs(argv) {
+  const args2 = { yes: false, overwrite: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--yes") args2.yes = true;
+    else if (a === "--overwrite") args2.overwrite = true;
+    else if (a === "--project" || a === "--dir") {
+      const value = argv[++i];
+      if (!value || value.startsWith("--")) throw new Error(`${a} needs a value
+${SETUP_USAGE}`);
+      if (a === "--project") {
+        if (!isWorkspace(value)) throw new Error(`${value} is not a project name (lower case letters, digits and -)`);
+        args2.project = value;
+      } else args2.dir = value;
+    } else throw new Error(`Unexpected argument ${a}
+${SETUP_USAGE}`);
+  }
+  return args2;
+}
+async function claudeCodeVersion() {
+  try {
+    const { stdout } = await run2("claude", ["--version"], {
+      shell: process.platform === "win32",
+      timeout: 3e4,
+      windowsHide: true
+    });
+    return stdout;
+  } catch {
+    return void 0;
+  }
+}
+function parseVersion(text3) {
+  const m = text3?.match(/(\d+)\.(\d+)\.(\d+)/);
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : void 0;
+}
+function olderThan(have, need) {
+  for (let i = 0; i < 3; i++) if (have[i] !== need[i]) return have[i] < need[i];
+  return false;
+}
+function skipSpace(t, i) {
+  while (i < t.length && /\s/.test(t[i])) i++;
+  return i;
+}
+function skipString(t, i) {
+  for (i++; i < t.length; i++) {
+    if (t[i] === "\\") i++;
+    else if (t[i] === '"') return i + 1;
+  }
+  return i;
+}
+function skipValue(t, i) {
+  if (t[i] === '"') return skipString(t, i);
+  if (t[i] === "{" || t[i] === "[") {
+    let depth = 0;
+    while (i < t.length) {
+      const c = t[i];
+      if (c === '"') {
+        i = skipString(t, i);
+        continue;
+      }
+      if (c === "{" || c === "[") depth++;
+      else if (c === "}" || c === "]") {
+        depth--;
+        if (depth === 0) return i + 1;
+      }
+      i++;
+    }
+    return i;
+  }
+  while (i < t.length && !/[\s,}\]]/.test(t[i])) i++;
+  return i;
+}
+function objectMembers(t, open) {
+  const members = [];
+  let i = skipSpace(t, open + 1);
+  if (t[i] === "}") return { members, close: i };
+  for (; ; ) {
+    i = skipSpace(t, i);
+    const keyStart = i;
+    const keyEnd = skipString(t, i);
+    const key = JSON.parse(t.slice(keyStart, keyEnd));
+    i = skipSpace(t, skipSpace(t, keyEnd) + 1);
+    const valueEnd = skipValue(t, i);
+    members.push({ key, keyStart, valueStart: i, valueEnd });
+    i = skipSpace(t, valueEnd);
+    if (t[i] === ",") i++;
+    else return { members, close: i };
+  }
+}
+function lineIndent(t, pos) {
+  const start = t.lastIndexOf("\n", pos - 1) + 1;
+  return /^[ \t]*/.exec(t.slice(start))[0];
+}
+function setJsonMember(text3, keys, value) {
+  const root = JSON.parse(text3);
+  if (!root || typeof root !== "object" || Array.isArray(root)) throw new Error("it does not hold a JSON object");
+  const compact = !text3.trimEnd().includes("\n");
+  const unit = /^([ \t]+)"/m.exec(text3)?.[1] ?? "  ";
+  const eol = text3.includes("\r\n") ? "\r\n" : "\n";
+  const render = (v, indent) => compact ? JSON.stringify(v) : JSON.stringify(v, null, unit).split("\n").join(eol + indent);
+  const nest = (from) => keys.slice(from).reduceRight((acc, k) => ({ [k]: acc }), value);
+  let open = skipSpace(text3, 0);
+  for (let k = 0; k < keys.length; k++) {
+    const { members, close } = objectMembers(text3, open);
+    const found = members.filter((m) => m.key === keys[k]).at(-1);
+    if (found) {
+      if (k < keys.length - 1 && text3[found.valueStart] === "{") {
+        open = found.valueStart;
+        continue;
+      }
+      return text3.slice(0, found.valueStart) + render(nest(k + 1), lineIndent(text3, found.keyStart)) + text3.slice(found.valueEnd);
+    }
+    const name = JSON.stringify(keys[k]);
+    if (compact) {
+      const member = `${name}:${render(nest(k + 1), "")}`;
+      if (members.length) return text3.slice(0, members.at(-1).valueEnd) + "," + member + text3.slice(members.at(-1).valueEnd);
+      return text3.slice(0, open + 1) + member + text3.slice(close);
+    }
+    if (members.length) {
+      const last = members.at(-1);
+      const indent2 = lineIndent(text3, last.keyStart);
+      return text3.slice(0, last.valueEnd) + `,${eol}${indent2}${name}: ${render(nest(k + 1), indent2)}` + text3.slice(last.valueEnd);
+    }
+    const outer = lineIndent(text3, open);
+    const indent = outer + unit;
+    return text3.slice(0, open + 1) + `${eol}${indent}${name}: ${render(nest(k + 1), indent)}${eol}${outer}` + text3.slice(close);
+  }
+  return text3;
+}
+function jsonAt(value, keys) {
+  let v = value;
+  for (const k of keys) v = v && typeof v === "object" ? v[k] : void 0;
+  return v;
+}
+async function setInJsonFile(path, keys, value) {
+  let text3;
+  try {
+    text3 = await readFile3(path, "utf8");
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+  }
+  let next;
+  if (text3 === void 0 || !text3.trim()) {
+    next = JSON.stringify(keys.reduceRight((acc, k) => ({ [k]: acc }), value), null, 2) + "\n";
+  } else {
+    let current;
+    try {
+      current = JSON.parse(text3);
+    } catch {
+      throw new SetupFailed(`${path} is not valid JSON: fix it, then run setup again.`);
+    }
+    if (JSON.stringify(jsonAt(current, keys)) === JSON.stringify(value)) return;
+    try {
+      next = setJsonMember(text3, keys, value);
+    } catch (e) {
+      throw new SetupFailed(`${path}: ${e.message}; fix it, then run setup again.`);
+    }
+  }
+  await mkdir3(dirname3(path), { recursive: true });
+  await writeFile3(path, next, "utf8");
+}
+function importBlock(workspace, eol = "\n") {
+  return [
+    `<!-- systemdox:${workspace} -->`,
+    `@~/.claude/systemdox/${workspace}/CLAUDE.md`,
+    `<!-- /systemdox:${workspace} -->`
+  ].join(eol);
+}
+function withImportBlock(text3, workspace) {
+  const eol = text3.includes("\r\n") ? "\r\n" : "\n";
+  const block = importBlock(workspace, eol);
+  const open = `<!-- systemdox:${workspace} -->`;
+  const close = `<!-- /systemdox:${workspace} -->`;
+  const start = text3.indexOf(open);
+  const end = start >= 0 ? text3.indexOf(close, start) : -1;
+  if (start >= 0 && end >= 0) return text3.slice(0, start) + block + text3.slice(end + close.length);
+  if (!text3) return block + eol;
+  return text3 + (text3.endsWith("\n") ? "" : eol) + block + eol;
+}
+async function readJsonQuietly(path) {
+  try {
+    return JSON.parse(await readFile3(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function chooseProject(own, opts, canAsk) {
+  if (opts.project) return opts.project;
+  if (own.memory.length <= 1) return own.memory[0]?.project;
+  const names = own.memory.map((m) => m.project);
+  const usage = `${own.workspace} has ${names.length} team memories (${names.join(", ")}): name this checkout's with --project.`;
+  if (!canAsk) throw new SetupFailed(usage);
+  const answer = (await opts.ask(`Which team memory is this checkout's? (${names.join(", ")}) `)).trim();
+  if (!names.includes(answer)) throw new SetupFailed(usage);
+  return answer;
+}
+async function runTeamSetup(opts) {
+  const { client, out } = opts;
+  try {
+    const own = await client.getOwnTeamSetup();
+    const ws = own.workspace;
+    if (!isWorkspace(ws)) throw new SetupFailed(`SystemDox named the workspace ${JSON.stringify(ws)}, which is not a workspace name.`);
+    const instructionsVersion = own.parts.instructions;
+    if (!own.plugin && instructionsVersion === void 0 && !own.memory.length && !opts.project) return 0;
+    const need = parseVersion(own.minClaudeCodeVersion);
+    const have = parseVersion(await (opts.claudeVersion ?? claudeCodeVersion)());
+    if (need && (!have || olderThan(have, need))) {
+      out(
+        have ? `Claude Code ${own.minClaudeCodeVersion} or later is needed for the team setup; this computer has ${have.join(".")}.` : `Claude Code ${own.minClaudeCodeVersion} or later is needed for the team setup; it was not found on this computer.`
+      );
+      out("Update it with: claude update");
+      out("Then run setup again. Nothing was changed.");
+      return 3;
+    }
+    const home = homeDir();
+    const userSettings = join3(home, ".claude", "settings.json");
+    const userClaudeMd = join3(home, ".claude", "CLAUDE.md");
+    const teamClaudeMd = join3(workspaceDir(ws), "CLAUDE.md");
+    const checkout = resolve2(opts.dir ?? opts.cwd ?? process.cwd());
+    const localSettings = join3(checkout, ".claude", "settings.local.json");
+    const state = await readState(ws);
+    const accepted = new Set(state.accepted ?? []);
+    const update = accepted.size > 0;
+    const canAsk = !!opts.ask && !(opts.yes && !opts.terminal);
+    const project = await chooseProject(own, opts, canAsk);
+    const marketplaceName = `systemdox-${ws}`;
+    const marketplace = { source: { source: "url", url: own.marketplaceUrl, headersHelper: HEADERS_HELPER } };
+    const items = [];
+    items.push(
+      item(`the marketplace ${marketplaceName} in ${userSettings} (extraKnownMarketplaces)`, [
+        `"${marketplaceName}": ${JSON.stringify(marketplace)}`
+      ])
+    );
+    const plugin = own.plugin;
+    let previousPlugin;
+    if (plugin) {
+      const hooks = hookLines(plugin);
+      const hooksName = `the hook commands of ${ws}-setup`;
+      const hooksItem = item(hooksName, hooks);
+      if (update && hooks.length && !accepted.has(hooksItem.sha256)) {
+        const versions = (await client.getPlugin(ws)).versions.filter((v) => v.version !== plugin.version);
+        previousPlugin = versions.sort((a, b) => b.version - a.version).find((v) => accepted.has(item(hooksName, hookLines(v)).sha256));
+      }
+      items.push(item(`the plugin ${ws}-setup, version ${plugin.version}`, [`${ws}-setup, version ${plugin.version}`]));
+      if (hooks.length) {
+        items.push(
+          item(
+            hooksName,
+            hooks,
+            previousPlugin ? lineDiff(hookLines(previousPlugin).join("\n"), hooks.join("\n")) : void 0
+          )
+        );
+      }
+      const servers = mcpLines(plugin);
+      if (servers.length) items.push(item(`the MCP servers of ${ws}-setup`, servers));
+    }
+    let instructions;
+    if (instructionsVersion !== void 0) {
+      const v = await client.getPartVersion(ws, "instructions", instructionsVersion);
+      const file = v.files.find((f) => f.path === "CLAUDE.md") ?? v.files[0];
+      instructions = { version: v.version, content: file?.content ?? "" };
+      const name = `the team instructions, written to ${teamClaudeMd}`;
+      const shown = item(name, instructions.content.split(/\r?\n/));
+      let diff;
+      const before = state.instructions;
+      if (update && !accepted.has(shown.sha256) && before && before.version !== instructions.version) {
+        const old = await client.getPartVersion(ws, "instructions", before.version);
+        const oldFile = old.files.find((f) => f.path === "CLAUDE.md") ?? old.files[0];
+        diff = lineDiff(oldFile?.content ?? "", instructions.content);
+      }
+      items.push({
+        ...shown,
+        lines: diff ?? [`version ${instructions.version}, ${instructions.content.split(/\r?\n/).length} lines`]
+      });
+      items.push(item(`the import block in ${userClaudeMd}`, importBlock(ws).split("\n")));
+    }
+    let memoryFolder;
+    if (project) {
+      memoryFolder = join3(workspaceDir(ws), "memory", project);
+      for (const m of own.memory) {
+        const folder = join3(workspaceDir(ws), "memory", m.project);
+        const count = `${m.fileCount} file${m.fileCount === 1 ? "" : "s"}`;
+        items.push({ ...item(`the team memory ${m.project}`, [folder]), lines: [`${m.project}: ${count}, synced into ${folder}`] });
+      }
+      if (!own.memory.some((m) => m.project === project)) {
+        items.push({ ...item(`the team memory ${project}`, [memoryFolder]), lines: [`${project}: new, synced into ${memoryFolder}`] });
+      }
+      items.push(item(`autoMemoryDirectory in ${localSettings}`, [memoryFolder]));
+    }
+    const pending = items.filter((i) => !accepted.has(i.sha256));
+    if (pending.length) {
+      if (!canAsk) {
+        out(`Not set up: ${pending.length === 1 ? "this needs" : "these need"} a person at a terminal (run setup without --yes):`);
+        for (const i of pending) {
+          out(`- ${i.name}:`);
+          for (const l of i.lines) out(`    ${l}`);
         }
-        return await res.json();
+        return 4;
       }
-      async post(path, body) {
-        return this.mutate("POST", path, body);
+      out(update ? `What changed in the team setup of ${ws}:` : `The team setup of ${ws} will add:`);
+      for (const i of pending) {
+        out(`- ${i.name}:`);
+        for (const l of i.lines) out(`    ${l}`);
       }
-      async put(path, body) {
-        return this.mutate("PUT", path, body);
+      const answer = (await opts.ask("Set this up? [y/N] ")).trim();
+      if (!/^y(es)?$/i.test(answer)) {
+        out("Nothing was changed.");
+        return 4;
       }
-      async mutate(method, path, body) {
-        const url = this.buildUrl(path);
-        const res = await fetch(url, {
-          method,
-          headers: {
-            // The API Gateway authorizer only reads the Authorization header;
-            // X-API-Key is kept for backwards compatibility.
-            Authorization: `Bearer ${this.config.apiKey}`,
-            "X-API-Key": this.config.apiKey,
-            "Content-Type": "application/json"
-          },
-          body: JSON.stringify(body)
-        });
-        if (!res.ok) {
-          const text2 = await res.text();
-          throw new Error(`SystemDox API error ${res.status}: ${text2}`);
-        }
-        return await res.json();
+    }
+    if (opts.keySource !== "credentials" && (await readCredentials())[ws]?.apiKey !== opts.apiKey) {
+      await writeCredentials(ws, opts.apiKey);
+    }
+    if (instructions) {
+      const next = sha2562(instructions.content);
+      let current;
+      try {
+        current = await readFile3(teamClaudeMd, "utf8");
+      } catch (e) {
+        if (e.code !== "ENOENT") throw e;
       }
-      invalidateCache(path) {
-        if (path) {
-          this.cache.invalidate(this.buildUrl(path).toString());
-        } else {
-          this.cache.clear();
-        }
+      const currentSha = current === void 0 ? void 0 : sha2562(current);
+      if (currentSha !== void 0 && currentSha !== next && currentSha !== state.instructions?.sha256 && !opts.overwrite) {
+        out(`${teamClaudeMd} was edited since setup installed it, so it was not replaced by version ${instructions.version}.`);
+        out("Keep your text elsewhere, then run setup --overwrite to replace it.");
+        return 2;
       }
-      buildUrl(path, params) {
-        const base = this.config.apiUrl.replace(/\/+$/, "");
-        const url = new URL(`${base}${path.startsWith("/") ? "" : "/"}${path}`);
-        if (params) {
-          for (const [key, value] of Object.entries(params)) {
-            url.searchParams.set(key, value);
-          }
-        }
-        return url;
+      if (currentSha !== next) {
+        await mkdir3(dirname3(teamClaudeMd), { recursive: true });
+        await writeFile3(teamClaudeMd, instructions.content, "utf8");
       }
-      async fetchRaw(path, params) {
-        const url = this.buildUrl(path, params);
-        return fetch(url, {
-          headers: {
-            Authorization: `Bearer ${this.config.apiKey}`,
-            "X-API-Key": this.config.apiKey,
-            Accept: "application/json"
-          }
-        });
+      await updateState(ws, (s) => {
+        s.instructions = { version: instructions.version, sha256: next };
+      });
+      let text3 = "";
+      try {
+        text3 = await readFile3(userClaudeMd, "utf8");
+      } catch (e) {
+        if (e.code !== "ENOENT") throw e;
+      }
+      const withBlock = withImportBlock(text3, ws);
+      if (withBlock !== text3) {
+        await mkdir3(dirname3(userClaudeMd), { recursive: true });
+        await writeFile3(userClaudeMd, withBlock, "utf8");
+      }
+    }
+    await setInJsonFile(userSettings, ["extraKnownMarketplaces", marketplaceName], marketplace);
+    await removeOldPlugins(ws);
+    if (project && memoryFolder) {
+      await setInJsonFile(localSettings, ["autoMemoryDirectory"], memoryFolder);
+    }
+    await updateState(ws, (s) => {
+      s.accepted = [...new Set(items.map((i) => i.sha256))];
+    });
+    if (project) {
+      const code = await syncMemory({
+        project,
+        dryRun: false,
+        client,
+        out: (...lines) => lines.forEach((l) => out(l)),
+        ask: opts.terminal ? opts.ask : void 0,
+        now: opts.now
+      });
+      if (code !== 0) return 1;
+    }
+    if (plugin) {
+      const pluginsDir = join3(home, ".claude", "plugins");
+      const id = `${ws}-setup@${marketplaceName}`;
+      const installed = await readJsonQuietly(join3(pluginsDir, "installed_plugins.json"));
+      if (!installed?.plugins?.[id]) {
+        const known = await readJsonQuietly(join3(pluginsDir, "known_marketplaces.json"));
+        const install = `Run \`claude plugin install ${id}\` in your own terminal and accept the command it shows.`;
+        const steps = known && typeof known === "object" && known[marketplaceName] ? ["One step is left:", `1. ${install}`] : ["Two steps are left:", "1. Open Claude Code once in any folder, then close it.", `2. ${install}`];
+        out("");
+        steps.forEach((l) => out(l));
       }
+    }
+    return 0;
+  } catch (e) {
+    out(e.message);
+    return 1;
+  }
+}
+async function removeOldPlugins(workspace) {
+  const root = pluginRoot(workspace);
+  if (!existsSync2(root)) return;
+  const versions = (await readdir2(root, { withFileTypes: true })).filter((e) => e.isDirectory() && /^\d+$/.test(e.name)).map((e) => Number(e.name)).sort((a, b) => b - a);
+  const old = versions.slice(2);
+  if (!old.length) return;
+  for (const v of old) await removeFolder(join3(root, String(v)));
+  await updateState(workspace, (s) => {
+    for (const v of old) delete s.plugin?.[String(v)];
+  });
+}
+async function runTeamSetupCommand(args2, key, io) {
+  const client = new SystemDoxApiClient({ apiKey: key.apiKey, apiUrl: key.apiUrl, cacheTtlMs: 0, defaultOrg: void 0 });
+  return runTeamSetup({ ...args2, client, apiKey: key.apiKey, keySource: "prompt", ...io });
+}
+var SETUP_USAGE, HEADERS_HELPER, SetupFailed, sha2562, run2, item, hookLines, mcpLines;
+var init_setup_team = __esm({
+  "src/setup-team.ts"() {
+    "use strict";
+    init_api_client();
+    init_memory_sync();
+    init_team_setup_files();
+    init_sync_memory();
+    SETUP_USAGE = "Usage: systemdox-mcp-server setup [--project <name>] [--dir <checkout>] [--yes] [--overwrite]";
+    HEADERS_HELPER = "npx -y @systemdox/mcp-server marketplace-auth";
+    SetupFailed = class extends Error {
     };
+    sha2562 = (text3) => createHash2("sha256").update(text3, "utf8").digest("hex");
+    run2 = promisify2(execFile2);
+    item = (name, lines, diff) => ({
+      name,
+      lines: diff ?? lines,
+      sha256: sha2562(`${name}
+${lines.join("\n")}`)
+    });
+    hookLines = (p) => p.hookCommands ?? [];
+    mcpLines = (p) => (p.mcpServers ?? []).map((s) => `${s.name}: ${s.url ?? [s.command, ...s.args ?? []].filter(Boolean).join(" ")}`);
   }
 });
 
 // src/lib/skills.ts
-import { createHash } from "crypto";
-import { lstat, mkdir, readdir, readFile, rm, writeFile } from "fs/promises";
-import { existsSync } from "fs";
-import { homedir } from "os";
-import { dirname, join, relative, resolve, sep } from "path";
-function sha256(content) {
-  return createHash("sha256").update(content, "utf8").digest("hex");
+import { createHash as createHash3 } from "crypto";
+import { lstat, mkdir as mkdir4, readdir as readdir3, readFile as readFile4, rm as rm3, writeFile as writeFile4 } from "fs/promises";
+import { existsSync as existsSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname4, join as join4, relative, resolve as resolve3, sep } from "path";
+function sha2563(content) {
+  return createHash3("sha256").update(content, "utf8").digest("hex");
 }
 function isValidName(name) {
   return name.length <= 64 && NAME_RE.test(name);
@@ -210,12 +1834,12 @@ function frontmatterName(skillMd) {
   return line ? line[1].replace(/^(['"])(.*)\1$/, "$2") : void 0;
 }
 function defaultSkillDir(name) {
-  return join(homedir(), ".claude", "skills", name);
+  return join4(homedir2(), ".claude", "skills", name);
 }
 async function walk(root, { skipHidden }, dir = root, out = { files: [], links: [], hidden: [] }) {
-  for (const entry of await readdir(dir, { withFileTypes: true })) {
+  for (const entry of await readdir3(dir, { withFileTypes: true })) {
     if (SKIPPED.has(entry.name) || entry.name.endsWith(".pyc")) continue;
-    const full = join(dir, entry.name);
+    const full = join4(dir, entry.name);
     const rel = relative(root, full).split(sep).join("/");
     if (entry.isSymbolicLink()) out.links.push(rel);
     else if (skipHidden && entry.name.startsWith(".")) out.hidden.push(rel);
@@ -225,18 +1849,9 @@ async function walk(root, { skipHidden }, dir = root, out = { files: [], links:
   out.files.sort();
   return out;
 }
-async function readSkillDirectory(directory) {
-  const root = resolve(directory);
-  if (!existsSync(join(root, ENTRY_FILE))) {
-    throw new Error(`${root} has no ${ENTRY_FILE}: a skill folder holds SKILL.md at its root`);
-  }
-  const walked = await walk(root, { skipHidden: true });
-  if (walked.links.length) {
-    throw new Error(`${walked.links.join(", ")}: links are not followed; copy the file into the skill folder`);
-  }
-  const paths = walked.files;
+async function readTextFiles(root, paths, what) {
   if (paths.length > MAX_FILES) {
-    throw new Error(`${root} holds ${paths.length} files: a skill holds at most ${MAX_FILES}`);
+    throw new Error(`${root} holds ${paths.length} files: ${what} holds at most ${MAX_FILES}`);
   }
   const decoder = new TextDecoder("utf-8", { fatal: true });
   const files = [];
@@ -245,8 +1860,8 @@ async function readSkillDirectory(directory) {
     if (!isValidPath(path)) {
       throw new Error(`${path}: file names may use letters, digits, ".", "_" and "-" only`);
     }
-    const raw = await readFile(join(root, ...path.split("/")));
-    if (raw.includes(0)) throw new Error(`${path} is binary: a skill holds text files only`);
+    const raw = await readFile4(join4(root, ...path.split("/")));
+    if (raw.includes(0)) throw new Error(`${path} is binary: ${what} holds text files only`);
     if (raw.length > MAX_FILE_BYTES) {
       throw new Error(`${path} is ${raw.length} bytes: a file holds at most ${MAX_FILE_BYTES}`);
     }
@@ -262,6 +1877,18 @@ async function readSkillDirectory(directory) {
     }
     files.push({ path, content });
   }
+  return files;
+}
+async function readSkillDirectory(directory) {
+  const root = resolve3(directory);
+  if (!existsSync3(join4(root, ENTRY_FILE))) {
+    throw new Error(`${root} has no ${ENTRY_FILE}: a skill folder holds SKILL.md at its root`);
+  }
+  const walked = await walk(root, { skipHidden: true });
+  if (walked.links.length) {
+    throw new Error(`${walked.links.join(", ")}: links are not followed; copy the file into the skill folder`);
+  }
+  const files = await readTextFiles(root, walked.files, "a skill");
   const skillMd = files.find((f) => f.path === ENTRY_FILE);
   const name = frontmatterName(skillMd.content);
   if (!name) throw new Error(`${ENTRY_FILE} has no frontmatter name`);
@@ -269,13 +1896,13 @@ async function readSkillDirectory(directory) {
 }
 function within(dest, path) {
   if (!isValidPath(path)) throw new Error(`refusing to write ${JSON.stringify(path)}: not a skill path`);
-  const full = resolve(dest, ...path.split("/"));
-  if (!full.startsWith(resolve(dest) + sep)) throw new Error(`refusing to write outside ${dest}: ${path}`);
+  const full = resolve3(dest, ...path.split("/"));
+  if (!full.startsWith(resolve3(dest) + sep)) throw new Error(`refusing to write outside ${dest}: ${path}`);
   return full;
 }
 async function readManifest(dest) {
   try {
-    return JSON.parse(await readFile(join(dest, MANIFEST_FILE), "utf8"));
+    return JSON.parse(await readFile4(join4(dest, MANIFEST_FILE), "utf8"));
   } catch {
     return void 0;
   }
@@ -284,10 +1911,10 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
   if (!isValidName(version.name)) throw new Error(`refusing to install ${JSON.stringify(version.name)}: not a skill name`);
   const incoming = new Map(version.files.map((f) => [f.path, f]));
   for (const f of version.files) within(dest, f.path);
-  if (existsSync(dest) && (await lstat(dest)).isSymbolicLink()) {
+  if (existsSync3(dest) && (await lstat(dest)).isSymbolicLink()) {
     throw new Error(`${dest} is a link: install into a real folder`);
   }
-  const walked = existsSync(dest) ? await walk(dest, { skipHidden: false }) : { files: [], links: [], hidden: [] };
+  const walked = existsSync3(dest) ? await walk(dest, { skipHidden: false }) : { files: [], links: [], hidden: [] };
   if (walked.links.length) {
     throw new Error(`${dest} holds links (${walked.links.join(", ")}): remove them, nothing was written`);
   }
@@ -299,10 +1926,10 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
   const edited = [];
   const untracked = [];
   for (const path of present) {
-    const content = await readFile(join(dest, ...path.split("/")), "utf8");
+    const content = await readFile4(join4(dest, ...path.split("/")), "utf8");
     if (Object.hasOwn(known, path)) {
-      if (sha256(content) !== known[path]) edited.push(path);
-    } else if (!incoming.has(path) || sha256(content) !== incoming.get(path).sha256) {
+      if (sha2563(content) !== known[path]) edited.push(path);
+    } else if (!incoming.has(path) || sha2563(content) !== incoming.get(path).sha256) {
       if (incoming.has(path) || !manifest) edited.push(path);
       else untracked.push(path);
     }
@@ -312,8 +1939,8 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
   const written = [];
   for (const f of version.files) {
     const full = within(dest, f.path);
-    await mkdir(dirname(full), { recursive: true });
-    await writeFile(full, f.content, "utf8");
+    await mkdir4(dirname4(full), { recursive: true });
+    await writeFile4(full, f.content, "utf8");
     written.push(f.path);
   }
   const removed = [];
@@ -324,7 +1951,7 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
       keptEdited.push(path);
       continue;
     }
-    await rm(within(dest, path));
+    await rm3(within(dest, path));
     removed.push(path);
   }
   const next = {
@@ -333,7 +1960,7 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
     installedAt: (/* @__PURE__ */ new Date()).toISOString(),
     files: Object.fromEntries(version.files.map((f) => [f.path, f.sha256]))
   };
-  await writeFile(join(dest, MANIFEST_FILE), JSON.stringify(next, null, 2) + "\n", "utf8");
+  await writeFile4(join4(dest, MANIFEST_FILE), JSON.stringify(next, null, 2) + "\n", "utf8");
   return {
     dest,
     version: version.version,
@@ -343,8 +1970,8 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
     keptEdited
   };
 }
-function fenceFor(text2) {
-  const longest = Math.max(0, ...(text2.match(/`+/g) ?? []).map((r) => r.length));
+function fenceFor(text3) {
+  const longest = Math.max(0, ...(text3.match(/`+/g) ?? []).map((r) => r.length));
   return "`".repeat(Math.max(3, longest + 1));
 }
 function describeInstall(name, r) {
@@ -392,7 +2019,7 @@ __export(install_skill_exports, {
   parseInstallArgs: () => parseInstallArgs,
   runInstallSkill: () => runInstallSkill
 });
-import { basename, resolve as resolve2 } from "path";
+import { basename, resolve as resolve4 } from "path";
 function parseInstallArgs(argv) {
   const args2 = { overwrite: false };
   for (let i = 0; i < argv.length; i++) {
@@ -413,7 +2040,7 @@ ${INSTALL_USAGE}`);
   }
   if (!args2.name) throw new Error(INSTALL_USAGE);
   if (!isValidName(args2.name)) throw new Error(`${args2.name} is not a skill name`);
-  if (args2.target && basename(resolve2(args2.target)) !== args2.name) {
+  if (args2.target && basename(resolve4(args2.target)) !== args2.name) {
     throw new Error(`--target must be a folder named ${args2.name} (e.g. .claude/skills/${args2.name})`);
   }
   return args2;
@@ -469,6 +2096,226 @@ var init_install_skill = __esm({
   }
 });
 
+// src/plugin-path.ts
+var plugin_path_exports = {};
+__export(plugin_path_exports, {
+  MAX_UNPACKED_BYTES: () => MAX_UNPACKED_BYTES,
+  PLUGIN_PATH_USAGE: () => PLUGIN_PATH_USAGE,
+  PluginRefused: () => PluginRefused,
+  parsePluginPathArgs: () => parsePluginPathArgs,
+  readZipEntries: () => readZipEntries,
+  runPluginPath: () => runPluginPath,
+  unpackZip: () => unpackZip
+});
+import { createHash as createHash4, randomBytes } from "crypto";
+import { existsSync as existsSync4 } from "fs";
+import { mkdir as mkdir5, rename as rename2, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname5, join as join5, resolve as resolve5, sep as sep2 } from "path";
+import { inflateRawSync } from "zlib";
+function parsePluginPathArgs(argv) {
+  const args2 = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--version" || a === "--sha256") {
+      const value = argv[++i];
+      if (!value) throw new Error(`${a} needs a value
+${PLUGIN_PATH_USAGE}`);
+      if (a === "--sha256") {
+        if (!SHA256_RE.test(value)) throw new Error(`--sha256 must be 64 lowercase hex characters, got ${value}`);
+        args2.sha256 = value;
+      } else if (/^[1-9]\d{0,8}$/.test(value)) args2.version = Number(value);
+      else throw new Error(`--version must be a whole number, got ${value}`);
+    } else if (a.startsWith("-")) throw new Error(`Unknown option ${a}
+${PLUGIN_PATH_USAGE}`);
+    else if (!args2.workspace) args2.workspace = a;
+    else throw new Error(`Unexpected argument ${a}
+${PLUGIN_PATH_USAGE}`);
+  }
+  if (!args2.workspace || !args2.version || !args2.sha256) throw new Error(PLUGIN_PATH_USAGE);
+  if (!isWorkspace(args2.workspace)) throw new Error(`${args2.workspace} is not a workspace name`);
+  return args2;
+}
+function refuse(name, why) {
+  throw new PluginRefused(`refused the plugin entry ${JSON.stringify(name)}: it ${why}. Nothing was unpacked.`);
+}
+function readZipEntries(zip) {
+  let eocd = -1;
+  for (let i = zip.length - 22; i >= Math.max(0, zip.length - 22 - 65535); i--) {
+    if (zip.readUInt32LE(i) === EOCD) {
+      eocd = i;
+      break;
+    }
+  }
+  if (eocd < 0) throw new PluginRefused("the download is not a zip. Nothing was unpacked.");
+  const count = zip.readUInt16LE(eocd + 10);
+  let at = zip.readUInt32LE(eocd + 16);
+  if (count === 65535 || at === 4294967295) throw new PluginRefused("the zip is a ZIP64 archive, which a plugin never is. Nothing was unpacked.");
+  const entries2 = [];
+  let total = 0;
+  for (let n = 0; n < count; n++) {
+    if (at + 46 > zip.length || zip.readUInt32LE(at) !== CENTRAL) {
+      throw new PluginRefused("the zip's directory is damaged. Nothing was unpacked.");
+    }
+    const madeBy = zip.readUInt16LE(at + 4);
+    const flags = zip.readUInt16LE(at + 8);
+    const method = zip.readUInt16LE(at + 10);
+    const compressedSize = zip.readUInt32LE(at + 20);
+    const size = zip.readUInt32LE(at + 24);
+    const nameLength = zip.readUInt16LE(at + 28);
+    const extraLength = zip.readUInt16LE(at + 30);
+    const commentLength = zip.readUInt16LE(at + 32);
+    const external = zip.readUInt32LE(at + 38);
+    const offset = zip.readUInt32LE(at + 42);
+    const name = zip.subarray(at + 46, at + 46 + nameLength).toString(flags & 2048 ? "utf8" : "latin1");
+    at += 46 + nameLength + extraLength + commentLength;
+    const unixMode = madeBy >> 8 === 3 ? external >>> 16 : 0;
+    const segments = name.split(/[\\/]/);
+    if (!name || /^[\\/]/.test(name) || /^[A-Za-z]:/.test(name)) refuse(name, "is absolute");
+    if (segments.includes("..")) refuse(name, "climbs out of the plugin folder (..)");
+    if (name.includes(":") || name.includes("\0")) refuse(name, "is not a plain relative path");
+    if ((unixMode & S_IFMT) === S_IFLNK) refuse(name, "is a link");
+    const directory = name.endsWith("/") || (unixMode & S_IFMT) === S_IFDIR;
+    if (!directory && unixMode && (unixMode & S_IFMT) !== S_IFREG) refuse(name, "is not a regular file");
+    if (flags & 1) refuse(name, "is encrypted");
+    if (!directory && method !== 0 && method !== 8) refuse(name, `uses compression method ${method}`);
+    total += size;
+    if (total > MAX_UNPACKED_BYTES) refuse(name, `takes the unpacked size past ${MAX_UNPACKED_BYTES} bytes`);
+    entries2.push({ name, directory, mode: unixMode ? unixMode & 511 : void 0, method, compressedSize, size, offset });
+  }
+  return entries2;
+}
+function entryData(zip, entry) {
+  const at = entry.offset;
+  if (at + 30 > zip.length || zip.readUInt32LE(at) !== LOCAL) refuse(entry.name, "has a damaged header");
+  const start = at + 30 + zip.readUInt16LE(at + 26) + zip.readUInt16LE(at + 28);
+  const raw = zip.subarray(start, start + entry.compressedSize);
+  let data;
+  try {
+    data = entry.method === 0 ? raw : inflateRawSync(raw, { maxOutputLength: Math.max(1, entry.size) + 1 });
+  } catch (e) {
+    refuse(entry.name, `cannot be unpacked (${e.message})`);
+  }
+  if (data.length !== entry.size) refuse(entry.name, "unpacks to a size other than the one it declares");
+  return data;
+}
+async function unpackZip(zip, dest) {
+  const entries2 = readZipEntries(zip);
+  const root = resolve5(dest);
+  const targets = entries2.map((e) => {
+    const full = resolve5(root, ...e.name.split(/[\\/]/).filter(Boolean));
+    if (full !== root && !full.startsWith(root + sep2)) refuse(e.name, "climbs out of the plugin folder");
+    return full;
+  });
+  const data = entries2.map((e) => e.directory ? void 0 : entryData(zip, e));
+  await mkdir5(root, { recursive: true });
+  for (const [i, entry] of entries2.entries()) {
+    if (entry.directory) {
+      await mkdir5(targets[i], { recursive: true });
+      continue;
+    }
+    await mkdir5(dirname5(targets[i]), { recursive: true });
+    await writeFile5(targets[i], data[i], { mode: entry.mode ?? 420 });
+  }
+  return entries2.filter((e) => !e.directory).length;
+}
+async function runPluginPath(argv, io) {
+  let args2;
+  try {
+    args2 = parsePluginPathArgs(argv);
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  const { workspace, version, sha256: sha2564 } = args2;
+  const folder = pluginDir(workspace, version);
+  try {
+    const state = await readState(workspace);
+    if (existsSync4(folder) && state.plugin?.[String(version)]?.sha256 === sha2564) {
+      io.out(folder);
+      return 0;
+    }
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  let client = io.client;
+  if (!client) {
+    try {
+      const apiUrl = apiUrlFrom();
+      const apiKey = await apiKeyFor(workspace);
+      if (!apiKey) {
+        io.err(
+          `No SystemDox key for ${workspace}. Set SYSTEMDOX_API_KEY, or run npx -y @systemdox/mcp-server setup, then run this again.`
+        );
+        return 1;
+      }
+      client = new SystemDoxApiClient({ apiKey, apiUrl, cacheTtlMs: 0, defaultOrg: void 0 });
+    } catch (e) {
+      io.err(e.message);
+      return 1;
+    }
+  }
+  let zip;
+  try {
+    ({ bytes: zip } = await client.getPluginZip(workspace, version));
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  const got = createHash4("sha256").update(zip).digest("hex");
+  if (got !== sha2564) {
+    io.err(
+      `The download of ${workspace}'s team plugin version ${version} has SHA-256 ${got}, not the ${sha2564} Claude Code named. Nothing was unpacked.`
+    );
+    return 2;
+  }
+  const tmp = join5(pluginRoot(workspace), `.${version}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`);
+  try {
+    await unpackZip(zip, tmp);
+    if (existsSync4(folder) && (await readState(workspace)).plugin?.[String(version)]?.sha256 === sha2564) {
+      await removeFolder(tmp);
+    } else {
+      if (existsSync4(folder)) await removeFolder(folder);
+      try {
+        await rename2(tmp, folder);
+      } catch (e) {
+        if (!existsSync4(folder)) throw e;
+        await removeFolder(tmp);
+      }
+    }
+    await updateState(workspace, (state) => {
+      state.plugin = { ...state.plugin, [String(version)]: { sha256: sha2564, installedAt: (/* @__PURE__ */ new Date()).toISOString() } };
+    });
+  } catch (e) {
+    await removeFolder(tmp);
+    io.err(e.message);
+    return e instanceof PluginRefused ? 2 : 1;
+  }
+  io.err(`Unpacked ${workspace}'s team plugin version ${version}.`);
+  io.out(folder);
+  return 0;
+}
+var PLUGIN_PATH_USAGE, MAX_UNPACKED_BYTES, SHA256_RE, PluginRefused, EOCD, CENTRAL, LOCAL, S_IFMT, S_IFLNK, S_IFDIR, S_IFREG;
+var init_plugin_path = __esm({
+  "src/plugin-path.ts"() {
+    "use strict";
+    init_api_client();
+    init_team_setup_files();
+    PLUGIN_PATH_USAGE = "Usage: systemdox-mcp-server plugin-path <workspace> --version <n> --sha256 <hash>";
+    MAX_UNPACKED_BYTES = 20 * 1024 * 1024;
+    SHA256_RE = /^[0-9a-f]{64}$/;
+    PluginRefused = class extends Error {
+    };
+    EOCD = 101010256;
+    CENTRAL = 33639248;
+    LOCAL = 67324752;
+    S_IFMT = 61440;
+    S_IFLNK = 40960;
+    S_IFDIR = 16384;
+    S_IFREG = 32768;
+  }
+});
+
 // src/lib/language.ts
 function detectLanguage(filePath) {
   const ext = filePath.slice(filePath.lastIndexOf("."));
@@ -601,12 +2448,12 @@ function registerGetGuardrails(server2, apiClient2) {
       );
     }
     if (filtered.length === 0) {
-      const text3 = guardrails.length === 0 ? `No checks found. Add checks at ${configLink("/docs/guardrails", await workspaceBase(apiClient2))}` : `No checks found${lang ? ` for language "${lang}"` : ""}${category ? ` in category "${category}"` : ""}.`;
+      const text4 = guardrails.length === 0 ? `No checks found. Add checks at ${configLink("/docs/guardrails", await workspaceBase(apiClient2))}` : `No checks found${lang ? ` for language "${lang}"` : ""}${category ? ` in category "${category}"` : ""}.`;
       return {
-        content: [{ type: "text", text: text3 }]
+        content: [{ type: "text", text: text4 }]
       };
     }
-    const text2 = filtered.map(
+    const text3 = filtered.map(
       (g) => `## ${g.title} [${g.severity}]
 
 ${g.description}
@@ -630,7 +2477,7 @@ ${g.fix}
           type: "text",
           text: `Found ${filtered.length} check(s):
 
-${text2}`
+${text3}`
         }
       ]
     };
@@ -741,7 +2588,7 @@ ${spec.taskContent}`);
           ]
         };
       }
-      const text2 = filtered.map(
+      const text3 = filtered.map(
         (s) => `- **${s.name}** (${s.draftId}) \u2014 ${s.status}, ${s.requirementCount} requirements` + (s.repoFullName ? `, repo: ${s.repoFullName}` : "")
       ).join("\n");
       return {
@@ -750,7 +2597,7 @@ ${spec.taskContent}`);
             type: "text",
             text: `Found ${filtered.length} spec(s):
 
-${text2}`
+${text3}`
           }
         ]
       };
@@ -808,18 +2655,18 @@ function registerGetDocs(server2, apiClient2) {
             isError: true
           };
         }
-        let text3 = doc.content;
+        let text4 = doc.content;
         if (anchor && doc.section_resolved === false) {
-          text3 = `_Section "${anchor}" not found \u2014 returning the full document._
+          text4 = `_Section "${anchor}" not found \u2014 returning the full document._
 
-` + text3;
+` + text4;
         } else if (anchor && doc.heading) {
-          text3 = `## ${doc.heading}
+          text4 = `## ${doc.heading}
 
 ${doc.content}`;
         }
         return {
-          content: [{ type: "text", text: text3 }]
+          content: [{ type: "text", text: text4 }]
         };
       }
       const params = {};
@@ -831,7 +2678,7 @@ ${doc.content}`;
       );
       let items = response.items;
       if (path) {
-        items = items.filter((item) => matchGlob(item.path, path));
+        items = items.filter((item2) => matchGlob(item2.path, path));
       }
       if (items.length === 0) {
         return {
@@ -843,7 +2690,7 @@ ${doc.content}`;
           ]
         };
       }
-      const text2 = items.map((d) => {
+      const text3 = items.map((d) => {
         const sections = (d.outline ?? []).slice(0, 8);
         const sectionHint = sections.length > 0 ? `
   sections: ${sections.map((s) => s.anchor).join(", ")}` : "";
@@ -857,7 +2704,7 @@ ${doc.content}`;
             type: "text",
             text: `Found ${items.length} document(s) (${response.total} total):
 
-${text2}
+${text3}
 
 Use doc_id for full content, or doc_id + section to fetch one section.`
           }
@@ -900,8 +2747,8 @@ function registerGetTechStack(server2, apiClient2) {
         list.push(entry);
         grouped.set(entry.category, list);
       }
-      const sections = Array.from(grouped.entries()).map(([category, entries]) => {
-        const items = entries.map(
+      const sections = Array.from(grouped.entries()).map(([category, entries2]) => {
+        const items = entries2.map(
           (e) => `- ${e.name}${e.version ? ` v${e.version}` : ""}${e.notes ? ` \u2014 ${e.notes}` : ""}`
         ).join("\n");
         return `### ${category}
@@ -1011,8 +2858,8 @@ var init_get_planning_context = __esm({
 
 // src/tools/get-plan-board.ts
 import { z as z5 } from "zod";
-function bucketOf(item) {
-  const status = (item.fields?.Status ?? "").trim().toLowerCase();
+function bucketOf(item2) {
+  const status = (item2.fields?.Status ?? "").trim().toLowerCase();
   if (status) {
     if (status.includes("done") || status.includes("ship") || status.includes("complete")) {
       return "done";
@@ -1022,7 +2869,7 @@ function bucketOf(item) {
     }
     return "todo";
   }
-  return item.state === "CLOSED" ? "done" : "todo";
+  return item2.state === "CLOSED" ? "done" : "todo";
 }
 function formatBoards(boards) {
   const lines = boards.map((b) => {
@@ -1033,16 +2880,16 @@ function formatBoards(boards) {
   });
   return lines.join("\n");
 }
-function formatItem(item) {
+function formatItem(item2) {
   const meta = [];
-  if (item.labels.length > 0) meta.push(`labels: ${item.labels.join(", ")}`);
-  if (item.assignees.length > 0)
-    meta.push(`assignees: ${item.assignees.join(", ")}`);
-  const epic = item.fields?.Epic;
+  if (item2.labels.length > 0) meta.push(`labels: ${item2.labels.join(", ")}`);
+  if (item2.assignees.length > 0)
+    meta.push(`assignees: ${item2.assignees.join(", ")}`);
+  const epic = item2.fields?.Epic;
   if (epic) meta.push(`epic: ${epic}`);
-  return `- #${item.number} ${item.title}${item.repo ? ` \u2014 ${item.repo}` : ""}` + (meta.length > 0 ? `
-  ${meta.join(" \xB7 ")}` : "") + (item.url ? `
-  ${item.url}` : "");
+  return `- #${item2.number} ${item2.title}${item2.repo ? ` \u2014 ${item2.repo}` : ""}` + (meta.length > 0 ? `
+  ${meta.join(" \xB7 ")}` : "") + (item2.url ? `
+  ${item2.url}` : "");
 }
 function registerGetPlanBoard(server2, apiClient2) {
   server2.registerTool(
@@ -1124,7 +2971,7 @@ Call get_plan_board with project_number to list a board's issues.`
         todo: [],
         done: []
       };
-      for (const item of allItems) grouped[bucketOf(item)].push(item);
+      for (const item2 of allItems) grouped[bucketOf(item2)].push(item2);
       const wanted = status ? [STATUS_ARG_TO_BUCKET[status]] : BUCKET_ORDER;
       const shown = wanted.reduce((n, b) => n + grouped[b].length, 0);
       if (shown === 0) {
@@ -1202,13 +3049,13 @@ var init_get_plan_board = __esm({
 });
 
 // src/lib/scoring.ts
-function estimateTokens(text2) {
-  return Math.ceil(text2.length / CHARS_PER_TOKEN);
+function estimateTokens(text3) {
+  return Math.ceil(text3.length / CHARS_PER_TOKEN);
 }
-function truncateToTokens(text2, maxTokens) {
+function truncateToTokens(text3, maxTokens) {
   const maxChars = Math.max(0, maxTokens) * CHARS_PER_TOKEN;
-  if (text2.length <= maxChars) return { text: text2, truncated: false };
-  const head = text2.slice(0, maxChars);
+  if (text3.length <= maxChars) return { text: text3, truncated: false };
+  const head = text3.slice(0, maxChars);
   const floor = Math.floor(maxChars * 0.75);
   const paragraph = head.lastIndexOf("\n\n");
   const line = head.lastIndexOf("\n");
@@ -1217,11 +3064,11 @@ function truncateToTokens(text2, maxTokens) {
   else if (line >= floor) cut = line;
   return { text: head.slice(0, cut).trimEnd(), truncated: true };
 }
-function scorePathMatch(item, languages, categories) {
+function scorePathMatch(item2, languages, categories) {
   if (languages.length === 0 && categories.length === 0) return 0.5;
   let score = 0;
-  const itemLang = item.language?.toLowerCase() ?? "";
-  const itemCat = item.category?.toLowerCase() ?? "";
+  const itemLang = item2.language?.toLowerCase() ?? "";
+  const itemCat = item2.category?.toLowerCase() ?? "";
   if (itemLang && languages.some((l) => itemLang.includes(l))) {
     score += 0.6;
   }
@@ -1230,30 +3077,30 @@ function scorePathMatch(item, languages, categories) {
   }
   return Math.min(score, 1);
 }
-function scoreKeywordMatch(item, keywords) {
+function scoreKeywordMatch(item2, keywords) {
   if (keywords.length === 0) return 0;
-  const searchable = `${item.title} ${item.content}`.toLowerCase();
+  const searchable = `${item2.title} ${item2.content}`.toLowerCase();
   let matches = 0;
   for (const kw of keywords) {
     if (searchable.includes(kw)) matches++;
   }
   return Math.min(matches / keywords.length, 1);
 }
-function scoreRecency(item) {
-  if (!item.updatedAt) return 0.5;
+function scoreRecency(item2) {
+  if (!item2.updatedAt) return 0.5;
   const now = Date.now();
-  const updated = new Date(item.updatedAt).getTime();
+  const updated = new Date(item2.updatedAt).getTime();
   const daysSince = (now - updated) / (1e3 * 60 * 60 * 24);
   if (daysSince <= 7) return 1;
   if (daysSince <= 30) return 0.75;
   if (daysSince <= 90) return 0.5;
   return 0.25;
 }
-function scoreSeverity(item) {
-  if (!item.severity) return 0.5;
-  return SEVERITY_SCORES[item.severity] ?? 0.5;
+function scoreSeverity(item2) {
+  if (!item2.severity) return 0.5;
+  return SEVERITY_SCORES[item2.severity] ?? 0.5;
 }
-function extractKeywords(text2) {
+function extractKeywords(text3) {
   const stopWords = /* @__PURE__ */ new Set([
     "the",
     "a",
@@ -1338,35 +3185,35 @@ function extractKeywords(text2) {
     "implement",
     "create"
   ]);
-  return text2.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !stopWords.has(w));
+  return text3.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !stopWords.has(w));
 }
 function scoreItems(items, taskDescription, filePaths) {
   const languages = detectLanguages(filePaths);
   const categories = detectCategories(filePaths);
   const keywords = extractKeywords(taskDescription);
-  return items.map((item) => {
-    const pathScore = scorePathMatch(item, languages, categories);
-    const keywordScore = scoreKeywordMatch(item, keywords);
-    const recencyScore = scoreRecency(item);
-    const severityScore = scoreSeverity(item);
+  return items.map((item2) => {
+    const pathScore = scorePathMatch(item2, languages, categories);
+    const keywordScore = scoreKeywordMatch(item2, keywords);
+    const recencyScore = scoreRecency(item2);
+    const severityScore = scoreSeverity(item2);
     const score = pathScore * WEIGHT_PATH + keywordScore * WEIGHT_KEYWORD + recencyScore * WEIGHT_RECENCY + severityScore * WEIGHT_SEVERITY;
     return {
-      type: item.type,
-      id: item.id,
-      title: item.title,
-      content: item.content,
+      type: item2.type,
+      id: item2.id,
+      title: item2.title,
+      content: item2.content,
       score,
-      tokenEstimate: estimateTokens(item.content)
+      tokenEstimate: estimateTokens(item2.content)
     };
   }).sort((a, b) => b.score - a.score);
 }
 function selectWithinBudget(items, maxTokens) {
   const selected = [];
   let tokensUsed = 0;
-  for (const item of items) {
-    if (tokensUsed + item.tokenEstimate > maxTokens) continue;
-    selected.push(item);
-    tokensUsed += item.tokenEstimate;
+  for (const item2 of items) {
+    if (tokensUsed + item2.tokenEstimate > maxTokens) continue;
+    selected.push(item2);
+    tokensUsed += item2.tokenEstimate;
   }
   return { selected, tokensUsed, totalItems: items.length };
 }
@@ -1391,20 +3238,20 @@ var init_scoring = __esm({
 
 // src/lib/context-builder.ts
 function formatGuardrail(g) {
-  let text2 = `## ${g.title} [${g.severity}]
+  let text3 = `## ${g.title} [${g.severity}]
 
 ${g.description}`;
-  if (g.pattern) text2 += `
+  if (g.pattern) text3 += `
 
 **Bad:** \`\`\`
 ${g.pattern}
 \`\`\``;
-  if (g.fix) text2 += `
+  if (g.fix) text3 += `
 
 **Good:** \`\`\`
 ${g.fix}
 \`\`\``;
-  return text2;
+  return text3;
 }
 function formatSpecHeadline(s) {
   return `### ${s.name}
@@ -1414,8 +3261,8 @@ function formatDocHeadline(d) {
   return `### ${d.title}
 \`doc_id: ${d.id}\` \xB7 \`${d.repo_full_name}/${d.path}\` \xB7 ${d.doc_type}`;
 }
-function formatStack(entries) {
-  return entries.map(
+function formatStack(entries2) {
+  return entries2.map(
     (e) => `- ${e.name}${e.version ? ` v${e.version}` : ""}${e.notes ? ` \u2014 ${e.notes}` : ""}`
   ).join("\n");
 }
@@ -1426,19 +3273,19 @@ function formatRules(rules) {
     if (!byCategory.has(cat)) byCategory.set(cat, []);
     byCategory.get(cat).push(r);
   }
-  let text2 = "";
+  let text3 = "";
   for (const [cat, catRules] of byCategory) {
-    text2 += `### ${cat.charAt(0).toUpperCase() + cat.slice(1)}
+    text3 += `### ${cat.charAt(0).toUpperCase() + cat.slice(1)}
 `;
     for (const r of catRules) {
-      text2 += `- ${r.text}
+      text3 += `- ${r.text}
 `;
     }
-    text2 += "\n";
+    text3 += "\n";
   }
   return `## Project Rules (${rules.length})
 
-${text2.trim()}`;
+${text3.trim()}`;
 }
 async function fetchSpecBody(api, draftId) {
   const spec = await api.get(
@@ -1496,13 +3343,13 @@ function selectSection(outline, taskDescription) {
   }
   return best;
 }
-async function hydrate(api, item, meta) {
+async function hydrate(api, item2, meta) {
   try {
     const body = meta.type === "spec" ? await fetchSpecBody(api, meta.id) : await fetchDocBody(api, meta.id, meta.section?.anchor);
-    return { item, meta, body };
+    return { item: item2, meta, body };
   } catch (err) {
     return {
-      item,
+      item: item2,
       meta,
       error: err instanceof Error ? err.message : String(err)
     };
@@ -1609,13 +3456,13 @@ ${formatStack(stack)}`;
     0,
     Math.max(0, Math.min(MAX_HYDRATED, affordable))
   );
-  for (const item of shortlist) {
-    remaining -= item.tokenEstimate;
+  for (const item2 of shortlist) {
+    remaining -= item2.tokenEstimate;
   }
   remaining = Math.max(0, remaining);
   const hydrated = await Promise.all(
     shortlist.map(
-      (item) => hydrate(api, item, refs.get(key(item.type, item.id)))
+      (item2) => hydrate(api, item2, refs.get(key(item2.type, item2.id)))
     )
   );
   const tailCandidates = rankedRefs.slice(shortlist.length, shortlist.length + MAX_TAIL).map((i) => refs.get(key(i.type, i.id)));
@@ -1792,13 +3639,13 @@ function registerGetContext(server2, apiClient2) {
       }
     },
     async ({ task_description, file_paths, max_tokens }) => {
-      const { text: text2 } = await buildContext(apiClient2, {
+      const { text: text3 } = await buildContext(apiClient2, {
         taskDescription: task_description,
         filePaths: file_paths,
         maxTokens: max_tokens
       });
       return {
-        content: [{ type: "text", text: text2 }]
+        content: [{ type: "text", text: text3 }]
       };
     }
   );
@@ -2061,9 +3908,9 @@ function registerGetProjectRules(server2, apiClient2) {
         );
       }
       if (filtered.length === 0) {
-        const text3 = rules.length === 0 ? `No project rules found. Add rules at ${configLink("/docs/rules", await workspaceBase(apiClient2))}` : `No project rules found${category ? ` in category "${category}"` : ""}.`;
+        const text4 = rules.length === 0 ? `No project rules found. Add rules at ${configLink("/docs/rules", await workspaceBase(apiClient2))}` : `No project rules found${category ? ` in category "${category}"` : ""}.`;
         return {
-          content: [{ type: "text", text: text3 }]
+          content: [{ type: "text", text: text4 }]
         };
       }
       const grouped = /* @__PURE__ */ new Map();
@@ -2072,25 +3919,25 @@ function registerGetProjectRules(server2, apiClient2) {
         if (!grouped.has(cat)) grouped.set(cat, []);
         grouped.get(cat).push(rule);
       }
-      let text2 = `Found ${filtered.length} project rule(s):
+      let text3 = `Found ${filtered.length} project rule(s):
 
 `;
       for (const [cat, catRules] of grouped) {
         const label = CATEGORY_LABELS[cat] ?? cat;
-        text2 += `## ${label}
+        text3 += `## ${label}
 
 `;
         for (const rule of catRules) {
-          text2 += `- ${rule.text}
+          text3 += `- ${rule.text}
 `;
         }
-        text2 += "\n";
+        text3 += "\n";
       }
       return {
         content: [
           {
             type: "text",
-            text: text2
+            text: text3
           }
         ]
       };
@@ -2131,10 +3978,10 @@ function registerCreateProjectRule(server2, apiClient2) {
         readOnlyHint: false
       }
     },
-    async ({ text: text2, category }) => {
+    async ({ text: text3, category }) => {
       const saved = await apiClient2.post(
         "/v1/standards/rules",
-        { text: text2, category }
+        { text: text3, category }
       );
       apiClient2.invalidateCache("/v1/standards/rules");
       return {
@@ -2177,7 +4024,7 @@ function registerGetPromptTemplates(server2, apiClient2) {
           ]
         };
       }
-      const text2 = templates.map(
+      const text3 = templates.map(
         (t) => `## ${t.name}
 
 ` + (t.description ? `*${t.description}*
@@ -2192,7 +4039,7 @@ ${t.prompt}
             type: "text",
             text: `Found ${templates.length} prompt template(s):
 
-${text2}`
+${text3}`
           }
         ]
       };
@@ -2252,10 +4099,10 @@ var init_create_prompt_template = __esm({
 
 // src/tools/skills.ts
 import { z as z13 } from "zod";
-import { homedir as homedir2 } from "os";
-import { basename as basename2, resolve as resolve3 } from "path";
+import { homedir as homedir3 } from "os";
+import { basename as basename2, resolve as resolve6 } from "path";
 function expandHome(path) {
-  return path.replace(/^~(?=$|[\\/])/, homedir2());
+  return path.replace(/^~(?=$|[\\/])/, homedir3());
 }
 function text(t) {
   return { content: [{ type: "text", text: t }] };
@@ -2357,7 +4204,7 @@ Left out (hidden files are never part of a skill): ${skipped.join(", ")}` : "")
       );
       if (localFiles) {
         const dest2 = args2.target ? expandHome(args2.target) : defaultSkillDir(version.name);
-        if (basename2(resolve3(dest2)) !== version.name) {
+        if (basename2(resolve6(dest2)) !== version.name) {
           throw new Error(`target must be a folder named ${version.name} (e.g. .claude/skills/${version.name}); got ${dest2}`);
         }
         const result = await installSkill(version, dest2, { overwrite: args2.overwrite });
@@ -2401,6 +4248,205 @@ var init_skills2 = __esm({
   }
 });
 
+// src/lib/team-setup-types.ts
+var PARTS, PERSON_ID_RE;
+var init_team_setup_types = __esm({
+  "src/lib/team-setup-types.ts"() {
+    "use strict";
+    init_person_values();
+    PARTS = ["hooks", "mcp", "agents", "commands", "instructions"];
+    PERSON_ID_RE = new RegExp(`^${PERSON_ID}$`);
+  }
+});
+
+// src/tools/team-setup.ts
+import { z as z14 } from "zod";
+import { existsSync as existsSync5 } from "fs";
+import { lstat as lstat2 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { join as join6, resolve as resolve7 } from "path";
+function expandHome2(path) {
+  return path.replace(/^~(?=$|[\\/])/, homedir4());
+}
+function text2(t) {
+  return { content: [{ type: "text", text: t }] };
+}
+async function isLink(path) {
+  try {
+    return (await lstat2(path)).isSymbolicLink();
+  } catch (e) {
+    if (e.code === "ENOENT") return false;
+    throw e;
+  }
+}
+async function readPartDirectory(part, directory) {
+  const root = resolve7(directory);
+  const layout = LAYOUT[part];
+  const paths = [];
+  const leftOut = [];
+  const links = [];
+  for (const path of layout.files) {
+    const segments = path.split("/");
+    let present = true;
+    for (let i = 1; i <= segments.length; i++) {
+      const rel = segments.slice(0, i).join("/");
+      if (await isLink(join6(root, ...segments.slice(0, i)))) {
+        links.push(rel);
+        present = false;
+        break;
+      }
+    }
+    if (present && existsSync5(join6(root, ...segments))) paths.push(path);
+  }
+  for (const { dir, md } of layout.folders) {
+    const full = join6(root, dir);
+    if (await isLink(full)) {
+      links.push(dir);
+      continue;
+    }
+    if (!existsSync5(full)) continue;
+    const walked = await walk(full, { skipHidden: true });
+    links.push(...walked.links.map((p) => `${dir}/${p}`));
+    leftOut.push(...walked.hidden.map((p) => `${dir}/${p}`));
+    for (const p of walked.files) {
+      if (md && !p.endsWith(".md")) leftOut.push(`${dir}/${p}`);
+      else paths.push(`${dir}/${p}`);
+    }
+  }
+  if (links.length) {
+    throw new Error(
+      `${links.join(", ")}: links are not followed; copy the file into the folder. Nothing was sent.`
+    );
+  }
+  if (layout.required && !paths.includes(layout.required)) {
+    throw new Error(`${root} has no ${layout.required}: the ${part} part needs it. Nothing was sent.`);
+  }
+  if (!paths.length) {
+    throw new Error(
+      `${root} has no ${layout.folders.map((f) => `${f.dir}/*.md`).join(" or ")}: nothing to publish for ${part}.`
+    );
+  }
+  return { files: await readTextFiles(root, paths.sort(), `the ${part} part`), leftOut };
+}
+function describePerson(id, person) {
+  const lines = [`**${person.label ?? "(no label)"}**, \`${id}\``];
+  if (person.mergedInto) {
+    lines.push(`\`${id}\` was merged into \`${person.mergedInto}\`: these are \`${person.mergedInto}\`'s details.`);
+  }
+  lines.push(`- Name: ${person.name ?? "(none held)"}`);
+  lines.push(`- Phone number: ${person.phone ?? "(none held)"}`);
+  lines.push(`- Email address: ${person.email ?? "(none held)"}`);
+  const token = `\`${person.mergedInto ?? id}\`${person.label ? ` (${person.label})` : ""}`;
+  lines.push(
+    "",
+    `These details are for this session only. Do not write them into a memory file, a note or a commit: a memory names this person by the identifier, as ${token}. A memory file that holds the details is offered for rewriting again at the next sync.`
+  );
+  return lines.join("\n");
+}
+function registerTeamSetupTools(server2, apiClient2, { localFiles }) {
+  const fileSchema = z14.object({
+    path: z14.string().describe(`Path inside the part's folder, forward slashes, e.g. "hooks/hooks.json"`),
+    content: z14.string().describe("The file's full text, exactly as it is")
+  });
+  server2.registerTool(
+    "publish_setup_part",
+    {
+      title: "Publish Setup Part",
+      description: "Publish one part of your team's Claude Code setup to SystemDox: `hooks` (hooks/hooks.json and the scripts/ it calls), `mcp` (.mcp.json), `agents` (agents/*.md), `commands` (commands/*.md) or `instructions` (CLAUDE.md). Every part but instructions makes a new version of the team plugin, which each member accepts at their next update. Publishing hooks, mcp, agents or commands needs the admin role. " + (localFiles ? "Pass `directory`: the server reads only the files the part accepts, byte for byte, and refuses a link, a binary file or a file too large before anything is sent. Never retype the files into `files` when the folder is on this computer." : "Pass every file of the part in `files`, exactly as it is."),
+      inputSchema: {
+        part: z14.enum(PARTS).describe("Which part of the setup"),
+        ...localFiles ? {
+          directory: z14.string().optional().describe(
+            "The folder on this computer: for hooks, the one holding hooks/hooks.json and scripts/; for mcp, the one holding .mcp.json; for instructions, the one holding CLAUDE.md; for agents or commands, the one holding agents/ or commands/"
+          )
+        } : {},
+        files: z14.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the part")
+      },
+      annotations: { readOnlyHint: false }
+    },
+    async (args2) => {
+      let files;
+      let leftOut = [];
+      if (localFiles && args2.directory) {
+        ({ files, leftOut } = await readPartDirectory(args2.part, expandHome2(args2.directory)));
+      } else if (args2.files?.length) {
+        files = args2.files;
+      } else {
+        throw new Error(localFiles ? "Pass `directory` (or `files`)." : "Pass `files`.");
+      }
+      const { workspace } = await apiClient2.getOwnTeamSetup();
+      const saved = await apiClient2.publishPartVersion(workspace, args2.part, files);
+      const lines = [`Published **${saved.part}** version ${saved.version}.`];
+      if (saved.part !== "instructions" && saved.pluginVersion !== void 0) {
+        lines.push(`Team plugin version ${saved.pluginVersion}; each member accepts it at their next update.`);
+      }
+      if (saved.replacedValues?.length) {
+        lines.push(
+          "Replaced by a reference to each member's own environment variable:",
+          ...saved.replacedValues.map((r) => `- ${r.server} ${r.field} ${r.name}: \${${r.name}}`)
+        );
+      }
+      if (leftOut.length) lines.push(`Left out (not part of ${args2.part}): ${leftOut.join(", ")}`);
+      return text2(lines.join("\n"));
+    }
+  );
+  server2.registerTool(
+    "resolve_person",
+    {
+      title: "Resolve Person",
+      description: "Read back a person that a team memory names by identifier, written as `con_\u2026` (label), `ctc_\u2026` or `usr_\u2026`: their label, name, phone number and email address, from the vault that holds them. The details are for this session only: never write them into a memory file; the memory keeps the identifier. Writes nothing.",
+      inputSchema: {
+        id: z14.string().regex(PERSON_ID_RE, "a con_, ctc_ or usr_ identifier, as written in the memory").describe("The identifier, e.g. con_01JC2Q8Y4M7T0X3K5N9P2R6S8V")
+      },
+      annotations: { readOnlyHint: true }
+    },
+    async (args2) => {
+      const { workspace } = await apiClient2.getOwnTeamSetup();
+      const person = await apiClient2.resolvePerson(workspace, args2.id);
+      return text2(describePerson(args2.id, person));
+    }
+  );
+  if (!localFiles) return;
+  server2.registerTool(
+    "sync_memory",
+    {
+      title: "Sync Memory",
+      description: `Sync one project's team memory on this computer with SystemDox: pull the files the team changed, push the ones changed here, keep both texts of a file changed on both sides. It never answers for a person: a file that still holds a phone number, an email address or a home-folder path is skipped and listed, with the command for the member to run in their own terminal (\`${SYNC_MEMORY_COMMAND}\`). Pass dryRun to see what it would do without writing or sending anything.`,
+      inputSchema: {
+        project: z14.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "a project name: lower case letters, digits and -").optional().describe("The project's team memory, e.g. puglieseweb-ltd; needed when the workspace has more than one"),
+        dryRun: z14.boolean().optional().describe("Show what would be pulled, pushed, deleted, conflicted and skipped, and change nothing")
+      },
+      annotations: { readOnlyHint: false }
+    },
+    async (args2) => {
+      const lines = [];
+      const code = await syncMemory({
+        project: args2.project,
+        dryRun: !!args2.dryRun,
+        client: apiClient2,
+        out: (...l) => lines.push(...l)
+      });
+      return { ...text2(lines.join("\n")), ...code ? { isError: true } : {} };
+    }
+  );
+}
+var LAYOUT;
+var init_team_setup = __esm({
+  "src/tools/team-setup.ts"() {
+    "use strict";
+    init_skills();
+    init_team_setup_types();
+    init_sync_memory();
+    LAYOUT = {
+      hooks: { files: ["hooks/hooks.json"], folders: [{ dir: "scripts", md: false }], required: "hooks/hooks.json" },
+      mcp: { files: [".mcp.json"], folders: [], required: ".mcp.json" },
+      agents: { files: [], folders: [{ dir: "agents", md: true }] },
+      commands: { files: [], folders: [{ dir: "commands", md: true }] },
+      instructions: { files: ["CLAUDE.md"], folders: [], required: "CLAUDE.md" }
+    };
+  }
+});
+
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 function createServer(apiClient2, { localFiles = false } = {}) {
@@ -2423,6 +4469,7 @@ function createServer(apiClient2, { localFiles = false } = {}) {
   registerCreateProjectRule(server2, apiClient2);
   registerCreatePromptTemplate(server2, apiClient2);
   registerSkillTools(server2, apiClient2, { localFiles });
+  registerTeamSetupTools(server2, apiClient2, { localFiles });
   return server2;
 }
 var SERVER_VERSION;
@@ -2444,7 +4491,8 @@ var init_server = __esm({
     init_get_prompt_templates();
     init_create_prompt_template();
     init_skills2();
-    SERVER_VERSION = true ? "0.1.45" : "0.0.0-dev";
+    init_team_setup();
+    SERVER_VERSION = true ? "0.1.47" : "0.0.0-dev";
   }
 });
 
@@ -2478,17 +4526,18 @@ var init_index = __esm({
 
 // src/cli.ts
 init_config();
-import { readFile as readFile2, writeFile as writeFile2, chmod } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join2 } from "path";
+init_team_setup_files();
+import { readFile as readFile5, writeFile as writeFile6, chmod as chmod2 } from "fs/promises";
+import { existsSync as existsSync6 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join7 } from "path";
 import { createInterface } from "readline";
 function prompt(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
+  return new Promise((resolve8) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve4(answer.trim());
+      resolve8(answer.trim());
     });
   });
 }
@@ -2508,45 +4557,45 @@ async function validateApiKey(apiKey, apiUrl) {
 }
 function findConfigTargets() {
   const targets = [];
-  const projectMcp = join2(process.cwd(), ".mcp.json");
+  const projectMcp = join7(process.cwd(), ".mcp.json");
   targets.push({
     name: "Claude Code (project)",
     path: projectMcp,
     detected: true
     // Always available
   });
-  const claudeUser = join2(homedir3(), ".claude.json");
+  const claudeUser = join7(homedir5(), ".claude.json");
   targets.push({
     name: "Claude Code (user \u2014 all projects)",
     path: claudeUser,
     detected: true
     // Always available
   });
-  const cursorProject = join2(process.cwd(), ".cursor", "mcp.json");
-  const cursorDir = join2(process.cwd(), ".cursor");
+  const cursorProject = join7(process.cwd(), ".cursor", "mcp.json");
+  const cursorDir = join7(process.cwd(), ".cursor");
   targets.push({
     name: "Cursor (project)",
     path: cursorProject,
-    detected: existsSync2(cursorDir)
+    detected: existsSync6(cursorDir)
   });
-  const vscodeProject = join2(process.cwd(), ".vscode", "mcp.json");
-  const vscodeDir = join2(process.cwd(), ".vscode");
+  const vscodeProject = join7(process.cwd(), ".vscode", "mcp.json");
+  const vscodeDir = join7(process.cwd(), ".vscode");
   targets.push({
     name: "VS Code (project)",
     path: vscodeProject,
-    detected: existsSync2(vscodeDir)
+    detected: existsSync6(vscodeDir)
   });
-  const cursorGlobal = join2(homedir3(), ".cursor", "mcp.json");
+  const cursorGlobal = join7(homedir5(), ".cursor", "mcp.json");
   targets.push({
     name: "Cursor (global)",
     path: cursorGlobal,
-    detected: existsSync2(join2(homedir3(), ".cursor"))
+    detected: existsSync6(join7(homedir5(), ".cursor"))
   });
   return targets;
 }
 async function readOrCreateConfig(path) {
   try {
-    const content = await readFile2(path, "utf-8");
+    const content = await readFile5(path, "utf-8");
     return JSON.parse(content);
   } catch {
     return { mcpServers: {} };
@@ -2554,13 +4603,13 @@ async function readOrCreateConfig(path) {
 }
 async function writeConfig(path, config2) {
   const dir = path.substring(0, path.lastIndexOf("/"));
-  if (!existsSync2(dir)) {
-    const { mkdir: mkdir2 } = await import("fs/promises");
-    await mkdir2(dir, { recursive: true });
+  if (!existsSync6(dir)) {
+    const { mkdir: mkdir6 } = await import("fs/promises");
+    await mkdir6(dir, { recursive: true });
   }
-  await writeFile2(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
+  await writeFile6(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
   try {
-    await chmod(path, 384);
+    await chmod2(path, 384);
   } catch {
   }
 }
@@ -2636,13 +4685,30 @@ async function setup() {
     console.log(`  Configured: ${target.name}`);
   }
   console.log(
-    "\n  Done! Restart your AI coding tool to activate the SystemDox MCP server.\n  The server provides 17 tools: get_context, get_checks,\n  get_project_rules, get_prompt_templates, get_specs, get_docs,\n  get_tech_stack, get_planning_context, get_plan_board, create_check,\n  create_project_rule, create_prompt_template, update_spec,\n  report_decision, publish_skill, list_skills, install_skill.\n\n  get_guardrails and create_guardrail remain registered as deprecated\n  aliases of get_checks and create_check \u2014 existing configs keep working.\n"
+    "\n  Done! Restart your AI coding tool to activate the SystemDox MCP server.\n  The server provides 20 tools: get_context, get_checks,\n  get_project_rules, get_prompt_templates, get_specs, get_docs,\n  get_tech_stack, get_planning_context, get_plan_board, create_check,\n  create_project_rule, create_prompt_template, update_spec,\n  report_decision, publish_skill, list_skills, install_skill,\n  publish_setup_part, resolve_person, sync_memory.\n\n  get_guardrails and create_guardrail remain registered as deprecated\n  aliases of get_checks and create_check \u2014 existing configs keep working.\n"
   );
+  return { apiKey, apiUrl };
 }
 var args = process.argv.slice(2);
 var command = args[0];
 if (command === "setup") {
-  setup().catch((err) => {
+  Promise.resolve().then(() => (init_setup_team(), setup_team_exports)).then(async ({ parseSetupArgs: parseSetupArgs2, runTeamSetupCommand: runTeamSetupCommand2 }) => {
+    let teamArgs;
+    try {
+      teamArgs = parseSetupArgs2(args.slice(1));
+    } catch (err) {
+      console.error(`
+  Error: ${err.message}
+`);
+      process.exit(1);
+    }
+    const key = await setup();
+    return runTeamSetupCommand2(teamArgs, key, {
+      out: console.log,
+      ask: (question) => prompt(question),
+      terminal: !!process.stdin.isTTY
+    });
+  }).then((code) => process.exit(code)).catch((err) => {
     console.error(`
   Error: ${err.message}
 `);
@@ -2652,20 +4718,54 @@ if (command === "setup") {
   Promise.resolve().then(() => (init_install_skill(), install_skill_exports)).then(
     ({ runInstallSkill: runInstallSkill2 }) => runInstallSkill2(args.slice(1), { out: console.log, err: console.error })
   ).then((code) => process.exit(code));
+} else if (command === "marketplace-auth") {
+  runMarketplaceAuth({ out: console.log, err: console.error }).then((code) => process.exit(code));
+} else if (command === "plugin-path") {
+  Promise.resolve().then(() => (init_plugin_path(), plugin_path_exports)).then(
+    ({ runPluginPath: runPluginPath2 }) => runPluginPath2(args.slice(1), { out: console.log, err: console.error })
+  ).then((code) => process.exit(code));
+} else if (command === "sync-memory") {
+  const terminal = !!process.stdin.isTTY && !!process.stdout.isTTY;
+  Promise.resolve().then(() => (init_sync_memory(), sync_memory_exports)).then(
+    ({ runSyncMemory: runSyncMemory2 }) => runSyncMemory2(args.slice(1), {
+      out: console.log,
+      err: console.error,
+      ask: terminal ? (question) => prompt(question) : void 0
+    })
+  ).then((code) => process.exit(code));
 } else if (command === "--help" || command === "-h") {
   console.log(`
   SystemDox MCP Server
 
   Usage:
     systemdox-mcp-server          Start the MCP server (stdio transport)
-    systemdox-mcp-server setup    Configure the MCP server in your AI coding tool
+    systemdox-mcp-server setup [--project <name>] [--dir <checkout>] [--yes] [--overwrite]
+                                  Configure the MCP server in your AI coding tool,
+                                  then your team's setup: the team instructions,
+                                  the plugin's marketplace and the project's team
+                                  memory (shown first; nothing changes until you
+                                  answer y)
     systemdox-mcp-server install-skill <name> [--version n] [--target dir] [--overwrite]
                                   Install a skill published to SystemDox
                                   (default folder: ~/.claude/skills/<name>)
+    systemdox-mcp-server plugin-path <workspace> --version <n> --sha256 <hash>
+                                  Print the folder of your team's plugin version,
+                                  downloading and checking it first when needed
+                                  (Claude Code runs it)
+    systemdox-mcp-server marketplace-auth
+                                  Print the header for your team's marketplace
+                                  (Claude Code runs it)
+    systemdox-mcp-server sync-memory [--project <name>] [--dir <folder>]
+                                  [--import <folder>] [--dry-run]
+                                  Sync a project's team memory with SystemDox
+                                  (default folder:
+                                  ~/.claude/systemdox/<workspace>/memory/<project>)
     systemdox-mcp-server --help   Show this help message
 
   Environment variables:
-    SYSTEMDOX_API_KEY             Your SystemDox API key (required)
+    SYSTEMDOX_API_KEY             Your SystemDox API key (required; plugin-path and
+                                  marketplace-auth also read
+                                  ~/.claude/systemdox/credentials.json)
     SYSTEMDOX_API_URL             API URL (default: ${API_URL_DEFAULT})
     SYSTEMDOX_CACHE_TTL           Cache TTL in seconds (default: 300)
     SYSTEMDOX_DEFAULT_ORG         Default GitHub org