@systemdox/mcp-server 0.1.47 → 0.1.49

package/dist/cli.js

@@ -26,8 +26,7 @@ function requireHttpsApiUrl(apiUrl) {
   }
   return apiUrl;
 }
-function loadConfig() {
-  const apiKey = process.env.SYSTEMDOX_API_KEY;
+function loadConfig(apiKey = process.env.SYSTEMDOX_API_KEY) {
   if (!apiKey) {
     throw new Error(
       "SYSTEMDOX_API_KEY is required. Generate one at your SystemDox settings page."
@@ -125,6 +124,31 @@ async function apiKeyFor(workspace, env = process.env) {
   const entry = (await readCredentials())[workspace];
   return typeof entry?.apiKey === "string" && entry.apiKey ? entry.apiKey : void 0;
 }
+async function localApiKey(env = process.env) {
+  if (env.SYSTEMDOX_API_KEY) return env.SYSTEMDOX_API_KEY;
+  const keys = Object.entries(await readCredentials()).filter(
+    (e) => typeof e[1]?.apiKey === "string" && e[1].apiKey.length > 0
+  );
+  const wanted = env.SYSTEMDOX_WORKSPACE;
+  if (wanted) {
+    const key = keys.find(([ws]) => ws === wanted)?.[1].apiKey;
+    if (key) return key;
+    throw new Error(
+      `~/.claude/systemdox/credentials.json holds no key for ${wanted} (SYSTEMDOX_WORKSPACE). Set SYSTEMDOX_API_KEY, or run npx -y @systemdox/mcp-server setup.`
+    );
+  }
+  if (keys.length === 1) return keys[0][1].apiKey;
+  if (keys.length > 1) {
+    throw new Error(
+      `~/.claude/systemdox/credentials.json holds keys for ${keys.map(([ws]) => ws).join(", ")}: set SYSTEMDOX_WORKSPACE to the workspace to use, or SYSTEMDOX_API_KEY to its key.`
+    );
+  }
+  throw new Error("No SystemDox key. Set SYSTEMDOX_API_KEY, or run npx -y @systemdox/mcp-server setup.");
+}
+async function loadLocalConfig(env = process.env) {
+  const apiKey = await localApiKey(env);
+  return loadConfig(apiKey);
+}
 function apiUrlFrom(env = process.env) {
   return requireHttpsApiUrl(env.SYSTEMDOX_API_URL || API_URL_DEFAULT);
 }
@@ -1141,17 +1165,6 @@ async function upload(client, ws, project, plan, team, report) {
   }
   await send();
 }
-async function keyFromEnvironment(env) {
-  if (env.SYSTEMDOX_API_KEY) return env.SYSTEMDOX_API_KEY;
-  const entries2 = Object.entries(await readCredentials()).filter(([, v]) => typeof v?.apiKey === "string" && v.apiKey);
-  if (entries2.length === 1) return entries2[0][1].apiKey;
-  if (entries2.length > 1) {
-    throw new SyncFailed(
-      `~/.claude/systemdox/credentials.json holds keys for ${entries2.map(([w]) => w).join(", ")}: set SYSTEMDOX_API_KEY to the key of the workspace to sync.`
-    );
-  }
-  throw new SyncFailed("No SystemDox key. Set SYSTEMDOX_API_KEY, or run npx -y @systemdox/mcp-server setup, then run this again.");
-}
 async function syncMemory(opts) {
   const { client, out } = opts;
   const now = opts.now?.() ?? /* @__PURE__ */ new Date();
@@ -1287,7 +1300,7 @@ async function runSyncMemory(argv, io, env = process.env) {
     args2 = parseSyncMemoryArgs(argv);
     if (!client) {
       const apiUrl = apiUrlFrom(env);
-      const apiKey = await keyFromEnvironment(env);
+      const apiKey = await localApiKey(env);
       client = new SystemDoxApiClient({ apiKey, apiUrl, cacheTtlMs: 0, defaultOrg: void 0 });
     }
   } catch (e) {
@@ -1380,6 +1393,7 @@ __export(setup_team_exports, {
   parseSetupArgs: () => parseSetupArgs,
   runTeamSetup: () => runTeamSetup,
   runTeamSetupCommand: () => runTeamSetupCommand,
+  setInJsonFile: () => setInJsonFile,
   setJsonMember: () => setJsonMember,
   withImportBlock: () => withImportBlock
 });
@@ -1812,12 +1826,190 @@ ${lines.join("\n")}`)
   }
 });
 
+// src/setup-mcp.ts
+var setup_mcp_exports = {};
+__export(setup_mcp_exports, {
+  findConfigTargets: () => findConfigTargets,
+  serverEntry: () => serverEntry,
+  setupMcpServer: () => setupMcpServer,
+  writeServerEntry: () => writeServerEntry
+});
+import { existsSync as existsSync3, readFileSync } from "fs";
+import { join as join4 } from "path";
+async function validateApiKey(apiKey, apiUrl) {
+  try {
+    const res = await fetch(`${apiUrl.replace(/\/+$/, "")}/v1/health`, {
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "X-API-Key": apiKey,
+        Accept: "application/json"
+      }
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+function findConfigTargets(cwd = process.cwd()) {
+  const home = homeDir();
+  return [
+    // Claude Code: the project's .mcp.json, and ~/.claude.json (all projects)
+    { name: "Claude Code (project)", path: join4(cwd, ".mcp.json"), detected: true },
+    { name: "Claude Code (user \u2014 all projects)", path: join4(home, ".claude.json"), detected: true },
+    { name: "Cursor (project)", path: join4(cwd, ".cursor", "mcp.json"), detected: existsSync3(join4(cwd, ".cursor")) },
+    { name: "VS Code (project)", path: join4(cwd, ".vscode", "mcp.json"), detected: existsSync3(join4(cwd, ".vscode")) },
+    { name: "Cursor (global)", path: join4(home, ".cursor", "mcp.json"), detected: existsSync3(join4(home, ".cursor")) }
+  ];
+}
+function serverEntry(apiUrl, existing, workspace) {
+  const env = {};
+  const old = existing && typeof existing === "object" ? existing.env : void 0;
+  if (old && typeof old === "object" && !Array.isArray(old)) {
+    for (const [name, value] of Object.entries(old)) {
+      if (typeof value !== "string" || name === "SYSTEMDOX_API_URL" || name === "SYSTEMDOX_WORKSPACE") continue;
+      if (name === "SYSTEMDOX_API_KEY" && !isReference(value)) continue;
+      env[name] = value;
+    }
+  }
+  if (apiUrl !== API_URL_DEFAULT) env.SYSTEMDOX_API_URL = apiUrl;
+  if (workspace) env.SYSTEMDOX_WORKSPACE = workspace;
+  const entry = { command: "npx", args: ["@systemdox/mcp-server"] };
+  if (Object.keys(env).length) entry.env = env;
+  return entry;
+}
+function currentEntry(path) {
+  let text3;
+  try {
+    text3 = readFileSync(path, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return void 0;
+    throw e;
+  }
+  if (!text3.trim()) return void 0;
+  let config2;
+  try {
+    config2 = JSON.parse(text3);
+  } catch {
+    throw new Error(`${path} is not valid JSON: fix it, then run setup again.`);
+  }
+  const servers = config2 && typeof config2 === "object" ? config2.mcpServers : void 0;
+  return servers && typeof servers === "object" ? servers.systemdox : void 0;
+}
+async function writeServerEntry(path, apiUrl, workspace) {
+  const existing = currentEntry(path);
+  const env = existing && typeof existing === "object" ? existing.env : void 0;
+  const heldKey = !!env && typeof env === "object" && "SYSTEMDOX_API_KEY" in env && !isReference(env.SYSTEMDOX_API_KEY);
+  await setInJsonFile(path, ["mcpServers", "systemdox"], serverEntry(apiUrl, existing, workspace));
+  return heldKey;
+}
+async function keyWorkspace(opts, apiKey, apiUrl) {
+  const client = opts.client?.(apiKey, apiUrl) ?? new SystemDoxApiClient({ apiKey, apiUrl, cacheTtlMs: 0, defaultOrg: void 0 });
+  try {
+    const { workspace } = await client.getOwnTeamSetup();
+    if (isWorkspace(workspace)) return workspace;
+    opts.out(`  SystemDox named the workspace ${JSON.stringify(workspace)}, which is not a workspace name.`);
+  } catch (e) {
+    opts.out(`  SystemDox did not name your key's workspace (${e.message}).`);
+  }
+  const fromEnv = (opts.env ?? process.env).SYSTEMDOX_WORKSPACE;
+  if (isWorkspace(fromEnv)) return fromEnv;
+  const typed = (await opts.ask("  Your workspace (acme in acme.systemdox.com): ")).trim().toLowerCase();
+  return isWorkspace(typed) ? typed : void 0;
+}
+async function setupMcpServer(opts) {
+  const { out, err, ask } = opts;
+  out("\n  SystemDox MCP Server Setup\n");
+  const apiKey = (await ask("  Enter your SystemDox API key: ")).trim();
+  if (!apiKey) {
+    err("\n  Error: API key is required.\n  Generate one at your SystemDox settings page.\n");
+    return { code: 1 };
+  }
+  const apiUrl = (await ask(`  API URL [${API_URL_DEFAULT}]: `)).trim() || API_URL_DEFAULT;
+  try {
+    requireHttpsApiUrl(apiUrl);
+  } catch (e) {
+    err(`
+  Error: ${e.message}
+`);
+    return { code: 1 };
+  }
+  out("\n  Validating API key...");
+  if (!await (opts.validateKey ?? validateApiKey)(apiKey, apiUrl)) {
+    err("\n  Error: Invalid API key or cannot reach the SystemDox API.\n  Check your key and try again.\n");
+    return { code: 1 };
+  }
+  out("  API key validated successfully.\n");
+  const workspace = await keyWorkspace(opts, apiKey, apiUrl);
+  if (!workspace) {
+    err("\n  Error: that is not a workspace name (lower case letters, digits and -). Nothing was changed.\n");
+    return { code: 1 };
+  }
+  const detected = findConfigTargets(opts.cwd).filter((t) => t.detected);
+  out("  Available targets:");
+  detected.forEach((t, i) => out(`    ${i + 1}. ${t.name} (${t.path})`));
+  const choice = (await ask(`
+  Which target? [1-${detected.length}, or 'all']: `)).trim();
+  let selected;
+  if (choice.toLowerCase() === "all") {
+    selected = detected;
+  } else {
+    const idx = parseInt(choice, 10) - 1;
+    if (isNaN(idx) || idx < 0 || idx >= detected.length) {
+      err("\n  Invalid selection.\n");
+      return { code: 1 };
+    }
+    selected = [detected[idx]];
+  }
+  try {
+    if ((await readCredentials())[workspace]?.apiKey !== apiKey) await writeCredentials(workspace, apiKey);
+    const several = Object.keys(await readCredentials()).length > 1;
+    for (const target of selected) {
+      const removed = await writeServerEntry(target.path, apiUrl, several ? workspace : void 0);
+      out(`  Configured: ${target.name}`);
+      if (removed) out(`  The key now lives in ~/.claude/systemdox/credentials.json and was removed from ${target.path}.`);
+    }
+  } catch (e) {
+    err(`
+  Error: ${e.message}
+`);
+    return { code: 1 };
+  }
+  out(
+    `
+  Your key for ${workspace} is in ${credentialsPath()} (readable by you alone), not in these configs.
+
+  Done! Restart your AI coding tool to activate the SystemDox MCP server.
+  The server provides 21 tools: get_context, get_checks,
+  get_project_rules, get_prompt_templates, get_specs, get_docs,
+  get_tech_stack, get_planning_context, get_plan_board, get_change,
+  create_check, create_project_rule, create_prompt_template,
+  update_spec, report_decision, publish_skill, list_skills,
+  install_skill, publish_setup_part, resolve_person, sync_memory.
+
+  get_guardrails and create_guardrail remain registered as deprecated
+  aliases of get_checks and create_check \u2014 existing configs keep working.
+`
+  );
+  return { code: 0, apiKey, apiUrl, workspace };
+}
+var isReference;
+var init_setup_mcp = __esm({
+  "src/setup-mcp.ts"() {
+    "use strict";
+    init_api_client();
+    init_config();
+    init_team_setup_files();
+    init_setup_team();
+    isReference = (value) => typeof value === "string" && /^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/.test(value);
+  }
+});
+
 // src/lib/skills.ts
 import { createHash as createHash3 } from "crypto";
 import { lstat, mkdir as mkdir4, readdir as readdir3, readFile as readFile4, rm as rm3, writeFile as writeFile4 } from "fs/promises";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join4, relative, resolve as resolve3, sep } from "path";
+import { dirname as dirname4, join as join5, relative, resolve as resolve3, sep } from "path";
 function sha2563(content) {
   return createHash3("sha256").update(content, "utf8").digest("hex");
 }
@@ -1834,12 +2026,12 @@ function frontmatterName(skillMd) {
   return line ? line[1].replace(/^(['"])(.*)\1$/, "$2") : void 0;
 }
 function defaultSkillDir(name) {
-  return join4(homedir2(), ".claude", "skills", name);
+  return join5(homedir2(), ".claude", "skills", name);
 }
 async function walk(root, { skipHidden }, dir = root, out = { files: [], links: [], hidden: [] }) {
   for (const entry of await readdir3(dir, { withFileTypes: true })) {
     if (SKIPPED.has(entry.name) || entry.name.endsWith(".pyc")) continue;
-    const full = join4(dir, entry.name);
+    const full = join5(dir, entry.name);
     const rel = relative(root, full).split(sep).join("/");
     if (entry.isSymbolicLink()) out.links.push(rel);
     else if (skipHidden && entry.name.startsWith(".")) out.hidden.push(rel);
@@ -1860,7 +2052,7 @@ async function readTextFiles(root, paths, what) {
     if (!isValidPath(path)) {
       throw new Error(`${path}: file names may use letters, digits, ".", "_" and "-" only`);
     }
-    const raw = await readFile4(join4(root, ...path.split("/")));
+    const raw = await readFile4(join5(root, ...path.split("/")));
     if (raw.includes(0)) throw new Error(`${path} is binary: ${what} holds text files only`);
     if (raw.length > MAX_FILE_BYTES) {
       throw new Error(`${path} is ${raw.length} bytes: a file holds at most ${MAX_FILE_BYTES}`);
@@ -1881,7 +2073,7 @@ async function readTextFiles(root, paths, what) {
 }
 async function readSkillDirectory(directory) {
   const root = resolve3(directory);
-  if (!existsSync3(join4(root, ENTRY_FILE))) {
+  if (!existsSync4(join5(root, ENTRY_FILE))) {
     throw new Error(`${root} has no ${ENTRY_FILE}: a skill folder holds SKILL.md at its root`);
   }
   const walked = await walk(root, { skipHidden: true });
@@ -1902,7 +2094,7 @@ function within(dest, path) {
 }
 async function readManifest(dest) {
   try {
-    return JSON.parse(await readFile4(join4(dest, MANIFEST_FILE), "utf8"));
+    return JSON.parse(await readFile4(join5(dest, MANIFEST_FILE), "utf8"));
   } catch {
     return void 0;
   }
@@ -1911,10 +2103,10 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
   if (!isValidName(version.name)) throw new Error(`refusing to install ${JSON.stringify(version.name)}: not a skill name`);
   const incoming = new Map(version.files.map((f) => [f.path, f]));
   for (const f of version.files) within(dest, f.path);
-  if (existsSync3(dest) && (await lstat(dest)).isSymbolicLink()) {
+  if (existsSync4(dest) && (await lstat(dest)).isSymbolicLink()) {
     throw new Error(`${dest} is a link: install into a real folder`);
   }
-  const walked = existsSync3(dest) ? await walk(dest, { skipHidden: false }) : { files: [], links: [], hidden: [] };
+  const walked = existsSync4(dest) ? await walk(dest, { skipHidden: false }) : { files: [], links: [], hidden: [] };
   if (walked.links.length) {
     throw new Error(`${dest} holds links (${walked.links.join(", ")}): remove them, nothing was written`);
   }
@@ -1926,7 +2118,7 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
   const edited = [];
   const untracked = [];
   for (const path of present) {
-    const content = await readFile4(join4(dest, ...path.split("/")), "utf8");
+    const content = await readFile4(join5(dest, ...path.split("/")), "utf8");
     if (Object.hasOwn(known, path)) {
       if (sha2563(content) !== known[path]) edited.push(path);
     } else if (!incoming.has(path) || sha2563(content) !== incoming.get(path).sha256) {
@@ -1960,7 +2152,7 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
     installedAt: (/* @__PURE__ */ new Date()).toISOString(),
     files: Object.fromEntries(version.files.map((f) => [f.path, f.sha256]))
   };
-  await writeFile4(join4(dest, MANIFEST_FILE), JSON.stringify(next, null, 2) + "\n", "utf8");
+  await writeFile4(join5(dest, MANIFEST_FILE), JSON.stringify(next, null, 2) + "\n", "utf8");
   return {
     dest,
     version: version.version,
@@ -2108,9 +2300,9 @@ __export(plugin_path_exports, {
   unpackZip: () => unpackZip
 });
 import { createHash as createHash4, randomBytes } from "crypto";
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { mkdir as mkdir5, rename as rename2, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname5, join as join5, resolve as resolve5, sep as sep2 } from "path";
+import { dirname as dirname5, join as join6, resolve as resolve5, sep as sep2 } from "path";
 import { inflateRawSync } from "zlib";
 function parsePluginPathArgs(argv) {
   const args2 = {};
@@ -2230,7 +2422,7 @@ async function runPluginPath(argv, io) {
   const folder = pluginDir(workspace, version);
   try {
     const state = await readState(workspace);
-    if (existsSync4(folder) && state.plugin?.[String(version)]?.sha256 === sha2564) {
+    if (existsSync5(folder) && state.plugin?.[String(version)]?.sha256 === sha2564) {
       io.out(folder);
       return 0;
     }
@@ -2269,17 +2461,17 @@ async function runPluginPath(argv, io) {
     );
     return 2;
   }
-  const tmp = join5(pluginRoot(workspace), `.${version}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`);
+  const tmp = join6(pluginRoot(workspace), `.${version}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`);
   try {
     await unpackZip(zip, tmp);
-    if (existsSync4(folder) && (await readState(workspace)).plugin?.[String(version)]?.sha256 === sha2564) {
+    if (existsSync5(folder) && (await readState(workspace)).plugin?.[String(version)]?.sha256 === sha2564) {
       await removeFolder(tmp);
     } else {
-      if (existsSync4(folder)) await removeFolder(folder);
+      if (existsSync5(folder)) await removeFolder(folder);
       try {
         await rename2(tmp, folder);
       } catch (e) {
-        if (!existsSync4(folder)) throw e;
+        if (!existsSync5(folder)) throw e;
         await removeFolder(tmp);
       }
     }
@@ -3048,6 +3240,153 @@ var init_get_plan_board = __esm({
   }
 });
 
+// src/tools/get-change.ts
+import { z as z6 } from "zod";
+function briefVerdict(states) {
+  const waiting = BRIEF.filter(
+    (part) => !(part === "decision" && states.decision === null) && !PAST_REVIEW.has(String(states[part]))
+  ).map((part) => `${part} is ${states[part] ?? "unknown"}`);
+  return waiting.length === 0 ? "The brief is passed" : `The brief is not passed: ${waiting.join(", ")}`;
+}
+function prLink(pr) {
+  return `[${pr.repo}#${pr.number}](${pr.url}) ${pr.state}`;
+}
+function fileSource(file) {
+  if (file.pullRequest) return prLink(file.pullRequest);
+  return file.direct ? "committed directly" : "\u2014";
+}
+function partPullRequests(change, part) {
+  const files = part === "contract" ? change.contract.files : part === "behaviour" ? change.behaviour.files : part === "plan" ? [change.plan.file] : [];
+  const prs = part === "decision" ? [change.decision?.pullRequest ?? null] : part === "release" ? change.release.prs : files.map((file) => file?.pullRequest ?? null);
+  const unique = /* @__PURE__ */ new Map();
+  for (const pr of prs) {
+    if (pr && !unique.has(`${pr.repo}#${pr.number}`)) unique.set(`${pr.repo}#${pr.number}`, pr);
+  }
+  return [...unique.values()].sort((a, b) => Number(b.state === "open") - Number(a.state === "open"));
+}
+function countsLine(counts) {
+  const tags = ["proposed", "built", "defect", "unbuilt", "open", "untagged"].filter((tag) => counts[tag] > 0).map((tag) => `${counts[tag]} ${tag}`);
+  return `${counts.total} scenario(s)` + (tags.length > 0 ? `: ${tags.join(", ")}` : "");
+}
+function partsTable(change) {
+  const rows = PARTS.filter((part) => !(part === "decision" && change.states.decision === null)).map((part) => {
+    const prs = partPullRequests(change, part);
+    return `| ${part} | ${change.states[part]} | ${prs.length > 0 ? prs.map(prLink).join(", ") : "\u2014"} |`;
+  });
+  return ["| Part | State | Pull request |", "|---|---|---|", ...rows].join("\n");
+}
+function decisionSection(change) {
+  const decision = change.decision;
+  if (decision === null) return "## Decision\n\nNone: the proposal names no ADR (a small change).";
+  const status = decision.status || "no record in a connected repository";
+  return `## Decision
+
+${decision.adr} \xB7 ${status}${decision.title ? ` \u2014 ${decision.title}` : ""}`;
+}
+function contractSection(change) {
+  const files = change.contract.files;
+  return "## Contract\n\n" + (files.length > 0 ? files.map((file) => `- ${file.path} \u2014 ${fileSource(file)}`).join("\n") : "No contract file yet (openapi.yaml, asyncapi.yaml or contract.md).");
+}
+function behaviourSection(change) {
+  const { files, counts } = change.behaviour;
+  if (files.length === 0) {
+    return `## Behaviour
+
+No feature file names this change. A feature file joins it when its path or its first ten lines name \`${change.slug}\`${change.decision ? ` or ${change.decision.adr}` : ""}.`;
+  }
+  const blocks = files.map(
+    (file) => [
+      `### ${file.path}`,
+      "",
+      [file.title, file.runner ? `runner ${file.runner}` : "", fileSource(file), countsLine(file.counts)].filter(Boolean).join(" \xB7 "),
+      "",
+      ...file.scenarios.map((s) => `- ${s.id || "(no id)"} \xB7 ${s.state || "untagged"} \xB7 ${s.title}`)
+    ].join("\n")
+  );
+  return ["## Behaviour", countsLine(counts), ...blocks].join("\n\n");
+}
+function planSection(change) {
+  const { file, draftId, board } = change.plan;
+  const boardLine = board ? `[#${board.number} ${board.title}](${board.url}) \u2014 todo ${board.items.todo} \xB7 in progress ${board.items.inProgress} \xB7 done ${board.items.done}` + (board.items.truncated ? " (counted over its first 500 items)" : "") : "none";
+  return [
+    "## Plan",
+    "",
+    `- plan.md: ${file ? `${file.path} \u2014 ${fileSource(file)}` : "none"}`,
+    `- Draft: ${draftId ?? "none"}`,
+    `- Board: ${boardLine}`
+  ].join("\n");
+}
+function releaseSection(change) {
+  const lines = change.release.prs.map(
+    (pr) => `- ${prLink(pr)} \xB7 ${pr.title} \xB7 ` + (pr.approvingReview ? `approved by ${pr.approvingReview.by} at ${pr.approvingReview.at}` : "no approving review on its head yet")
+  );
+  return `## Release
+
+${lines.length > 0 ? lines.join("\n") : "No release pull request is open."}`;
+}
+function formatChange(change) {
+  const header = `# ${change.title}
+
+\`${change.key}\` \xB7 size: ${change.size}` + (change.archived ? " \xB7 archived: read-only, done" : "") + ` \xB7 synced ${change.syncedAt}`;
+  return [
+    header,
+    partsTable(change),
+    decisionSection(change),
+    contractSection(change),
+    behaviourSection(change),
+    planSection(change),
+    releaseSection(change),
+    // Compact: a change's every scenario with its steps rides in this block.
+    "```json\n" + JSON.stringify(change) + "\n```",
+    briefVerdict(change.states)
+  ].join("\n\n");
+}
+function registerGetChange(server2, apiClient2) {
+  server2.registerTool(
+    "get_change",
+    {
+      title: "Get Change",
+      description: `Read one change (a specs/changes/<slug>/ folder of a connected repository) as SystemDox last synced it from GitHub: the state of each part of its brief (decision, contract, behaviour, plan) and of its release, each with its pull request; the decision's ADR and status; the contract files; every feature file that names the change, with its scenarios as id \xB7 state \xB7 title; the plan (plan.md, the draft, the board); the release pull requests; and the Change object as JSON. The last line says "The brief is passed" or "The brief is not passed: <part> is <state>". Call it before building a story, and stop if the brief is not passed or the story's scenarios are not proposed. Read-only.`,
+      inputSchema: {
+        repo: z6.string().regex(REPO_RE, "the repository as owner/name, e.g. acme/booking-api").describe("The repository that holds the change, as owner/name"),
+        slug: z6.string().max(SLUG_MAX).regex(SLUG_RE2, "a change folder's name: lower-case words joined by -, e.g. customer-reminders").describe("The change's folder name: specs/changes/<slug>/")
+      },
+      annotations: { readOnlyHint: true }
+    },
+    async ({ repo, slug }) => {
+      const [owner, name] = repo.split("/");
+      let change;
+      try {
+        change = await apiClient2.getFresh(
+          `/v1/changes/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/${encodeURIComponent(slug)}`
+        );
+      } catch (err) {
+        if (err.status === 404) {
+          return {
+            content: [{ type: "text", text: `No such change ${repo}/${slug}` }],
+            isError: true
+          };
+        }
+        throw err;
+      }
+      return { content: [{ type: "text", text: formatChange(change) }] };
+    }
+  );
+}
+var GITHUB_NAME, REPO_RE, SLUG_RE2, SLUG_MAX, PARTS, BRIEF, PAST_REVIEW;
+var init_get_change = __esm({
+  "src/tools/get-change.ts"() {
+    "use strict";
+    GITHUB_NAME = "[A-Za-z0-9][A-Za-z0-9._-]{0,99}";
+    REPO_RE = new RegExp(`^${GITHUB_NAME}/${GITHUB_NAME}$`);
+    SLUG_RE2 = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+    SLUG_MAX = 64;
+    PARTS = ["decision", "contract", "behaviour", "plan", "release"];
+    BRIEF = ["decision", "contract", "behaviour", "plan"];
+    PAST_REVIEW = /* @__PURE__ */ new Set(["passed", "being built", "done"]);
+  }
+});
+
 // src/lib/scoring.ts
 function estimateTokens(text3) {
   return Math.ceil(text3.length / CHARS_PER_TOKEN);
@@ -3621,7 +3960,7 @@ var init_context_builder = __esm({
 });
 
 // src/tools/get-context.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 function registerGetContext(server2, apiClient2) {
   server2.registerTool(
     "get_context",
@@ -3629,13 +3968,13 @@ function registerGetContext(server2, apiClient2) {
       title: "Get Context",
       description: "Intelligent context aggregator: fetches checks, specs, docs, and tech stack, ranks them by relevance to your current task, and returns the full text of the highest-ranked items within a token budget \u2014 each with the ID needed to fetch the rest. Use this instead of calling individual tools when you want curated, relevant context.",
       inputSchema: {
-        task_description: z6.string().describe(
+        task_description: z7.string().describe(
           "What you're working on (e.g., 'add a new REST endpoint for user preferences')"
         ),
-        file_paths: z6.array(z6.string()).optional().describe(
+        file_paths: z7.array(z7.string()).optional().describe(
           "File paths being edited \u2014 used for language/category detection"
         ),
-        max_tokens: z6.number().optional().describe("Maximum token budget for the response (default: 4000)")
+        max_tokens: z7.number().optional().describe("Maximum token budget for the response (default: 4000)")
       }
     },
     async ({ task_description, file_paths, max_tokens }) => {
@@ -3658,7 +3997,7 @@ var init_get_context = __esm({
 });
 
 // src/tools/create-guardrail.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 function registerCreateGuardrail(server2, apiClient2) {
   const handler = async ({
     title,
@@ -3738,19 +4077,19 @@ var init_create_guardrail = __esm({
       "data-access"
     ];
     inputSchema2 = () => ({
-      title: z7.string().describe("Short title for the check"),
-      description: z7.string().describe("Detailed description of what the check enforces and why"),
-      severity: z7.enum(["critical", "high", "medium", "low"]).describe("Severity level"),
-      category: z7.enum(CATEGORIES).optional().describe("Category (defaults to conventions)"),
-      pattern: z7.string().optional().describe("Bad code pattern that should be avoided"),
-      fix: z7.string().optional().describe("Correct code pattern to use instead"),
-      fitness_test: z7.string().optional().describe("Shell command to detect violations in CI")
+      title: z8.string().describe("Short title for the check"),
+      description: z8.string().describe("Detailed description of what the check enforces and why"),
+      severity: z8.enum(["critical", "high", "medium", "low"]).describe("Severity level"),
+      category: z8.enum(CATEGORIES).optional().describe("Category (defaults to conventions)"),
+      pattern: z8.string().optional().describe("Bad code pattern that should be avoided"),
+      fix: z8.string().optional().describe("Correct code pattern to use instead"),
+      fitness_test: z8.string().optional().describe("Shell command to detect violations in CI")
     });
   }
 });
 
 // src/tools/update-spec.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 function registerUpdateSpec(server2, apiClient2) {
   server2.registerTool(
     "update_spec",
@@ -3758,12 +4097,12 @@ function registerUpdateSpec(server2, apiClient2) {
       title: "Update Spec",
       description: "Update an existing SystemDox spec's proposal, tasks, or requirements. Only draft specs can be modified \u2014 published specs must be versioned first.",
       inputSchema: {
-        draft_id: z8.string().describe("ID of the spec to update"),
-        section: z8.enum(["proposal", "tasks", "requirements"]).describe("Which section to update"),
-        content: z8.string().describe(
+        draft_id: z9.string().describe("ID of the spec to update"),
+        section: z9.enum(["proposal", "tasks", "requirements"]).describe("Which section to update"),
+        content: z9.string().describe(
           "New markdown content for the section. For requirements, provide the full requirement content."
         ),
-        requirement_name: z8.string().optional().describe(
+        requirement_name: z9.string().optional().describe(
           "Name of the requirement (required when section is 'requirements')"
         )
       },
@@ -3818,7 +4157,7 @@ var init_update_spec = __esm({
 });
 
 // src/tools/report-decision.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function registerReportDecision(server2, apiClient2) {
   server2.registerTool(
     "report_decision",
@@ -3826,11 +4165,11 @@ function registerReportDecision(server2, apiClient2) {
       title: "Report Decision",
       description: "Record an architecture decision made during development. Creates a draft ADR in SystemDox for human review.",
       inputSchema: {
-        title: z9.string().describe("Decision title (e.g., 'Use WebSocket for real-time updates')"),
-        context: z9.string().describe("What prompted this decision \u2014 the problem or constraint"),
-        decision: z9.string().describe("What was decided and why"),
-        consequences: z9.string().describe("What this decision means going forward \u2014 trade-offs, follow-up work"),
-        related_files: z9.array(z9.string()).optional().describe("File paths related to this decision")
+        title: z10.string().describe("Decision title (e.g., 'Use WebSocket for real-time updates')"),
+        context: z10.string().describe("What prompted this decision \u2014 the problem or constraint"),
+        decision: z10.string().describe("What was decided and why"),
+        consequences: z10.string().describe("What this decision means going forward \u2014 trade-offs, follow-up work"),
+        related_files: z10.array(z10.string()).optional().describe("File paths related to this decision")
       },
       annotations: {
         readOnlyHint: false
@@ -3886,7 +4225,7 @@ var init_report_decision = __esm({
 });
 
 // src/tools/get-project-rules.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function registerGetProjectRules(server2, apiClient2) {
   server2.registerTool(
     "get_project_rules",
@@ -3894,7 +4233,7 @@ function registerGetProjectRules(server2, apiClient2) {
       title: "Get Project Rules",
       description: "Retrieve project rules defined in SystemDox Standards. These are team-defined principles covering deployment, architecture, security, testing, and process. Filter by category to get only relevant rules.",
       inputSchema: {
-        category: z10.enum(["deployment", "architecture", "security", "testing", "process", "other"]).optional().describe("Filter by rule category")
+        category: z11.enum(["deployment", "architecture", "security", "testing", "process", "other"]).optional().describe("Filter by rule category")
       }
     },
     async ({ category }) => {
@@ -3961,7 +4300,7 @@ var init_get_project_rules = __esm({
 });
 
 // src/tools/create-project-rule.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 function registerCreateProjectRule(server2, apiClient2) {
   server2.registerTool(
     "create_project_rule",
@@ -3969,10 +4308,10 @@ function registerCreateProjectRule(server2, apiClient2) {
       title: "Create Project Rule",
       description: "Create a new project rule in SystemDox Standards. Use this when you discover a team principle or convention that should be enforced across the project.",
       inputSchema: {
-        text: z11.string().describe(
+        text: z12.string().describe(
           "The rule statement \u2014 one enforceable principle per rule (e.g. 'All deployments MUST go through GitHub Actions workflows')"
         ),
-        category: z11.enum(["deployment", "architecture", "security", "testing", "process", "other"]).describe("Rule category")
+        category: z12.enum(["deployment", "architecture", "security", "testing", "process", "other"]).describe("Rule category")
       },
       annotations: {
         readOnlyHint: false
@@ -4054,7 +4393,7 @@ var init_get_prompt_templates = __esm({
 });
 
 // src/tools/create-prompt-template.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function registerCreatePromptTemplate(server2, apiClient2) {
   server2.registerTool(
     "create_prompt_template",
@@ -4062,9 +4401,9 @@ function registerCreatePromptTemplate(server2, apiClient2) {
       title: "Create Prompt Template",
       description: "Create a new reusable prompt template in SystemDox Standards. Use this to store preconfigured prompts for common AI tasks like code reviews, documentation generation, or analysis frameworks.",
       inputSchema: {
-        name: z12.string().describe("Short name for the template"),
-        description: z12.string().optional().describe("Brief description of when to use this template"),
-        prompt: z12.string().describe("The full prompt text that Gen AI will use when generating content")
+        name: z13.string().describe("Short name for the template"),
+        description: z13.string().optional().describe("Brief description of when to use this template"),
+        prompt: z13.string().describe("The full prompt text that Gen AI will use when generating content")
       },
       annotations: {
         readOnlyHint: false
@@ -4098,7 +4437,7 @@ var init_create_prompt_template = __esm({
 });
 
 // src/tools/skills.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 import { homedir as homedir3 } from "os";
 import { basename as basename2, resolve as resolve6 } from "path";
 function expandHome(path) {
@@ -4108,9 +4447,9 @@ function text(t) {
   return { content: [{ type: "text", text: t }] };
 }
 function registerSkillTools(server2, apiClient2, { localFiles }) {
-  const fileSchema = z13.object({
-    path: z13.string().describe('Path inside the skill folder, forward slashes, e.g. "references/guide.md"'),
-    content: z13.string().describe("The file's full text, exactly as it is")
+  const fileSchema = z14.object({
+    path: z14.string().describe('Path inside the skill folder, forward slashes, e.g. "references/guide.md"'),
+    content: z14.string().describe("The file's full text, exactly as it is")
   });
   server2.registerTool(
     "publish_skill",
@@ -4119,13 +4458,13 @@ function registerSkillTools(server2, apiClient2, { localFiles }) {
       description: localFiles ? "Publish a Claude Code skill folder (SKILL.md plus its references and scripts) to SystemDox so it can be installed on any computer. Pass `directory` (e.g. ~/.claude/skills/<name>): the server reads the files itself, byte for byte. Publishing a name again makes a new version. Never retype the files into `files` when the folder is on this computer." : "Publish a Claude Code skill (SKILL.md plus its references and scripts) to SystemDox so it can be installed on any computer. Pass every file of the folder in `files`, exactly as it is. Publishing a name again makes a new version.",
       inputSchema: {
         ...localFiles ? {
-          directory: z13.string().optional().describe("The skill folder on this computer, holding SKILL.md at its root")
+          directory: z14.string().optional().describe("The skill folder on this computer, holding SKILL.md at its root")
         } : {},
-        files: z13.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the skill folder"),
-        name: z13.string().optional().describe("The skill's name; defaults to SKILL.md's frontmatter name and must match it"),
-        spaceId: z13.string().optional().describe("Space for a NEW skill (default: your default space)"),
-        note: z13.string().max(500).optional().describe(`A short change note for this version, shown in the console's history (e.g. "Fix the GA4 step")`),
-        baseVersion: z13.number().int().positive().optional().describe(
+        files: z14.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the skill folder"),
+        name: z14.string().optional().describe("The skill's name; defaults to SKILL.md's frontmatter name and must match it"),
+        spaceId: z14.string().optional().describe("Space for a NEW skill (default: your default space)"),
+        note: z14.string().max(500).optional().describe(`A short change note for this version, shown in the console's history (e.g. "Fix the GA4 step")`),
+        baseVersion: z14.number().int().positive().optional().describe(
           "The version these files were edited from. When given, the publish is refused (SYD-K017) if someone published a newer version since, instead of replacing their changes"
         )
       },
@@ -4175,7 +4514,7 @@ Left out (hidden files are never part of a skill): ${skipped.join(", ")}` : "")
       const { skills } = await apiClient2.get(SKILLS);
       if (!skills.length) {
         return text(
-          `No skills published yet. Publish one with publish_skill; they appear at ${configLink("/docs/skills", await workspaceBase(apiClient2))}`
+          `No skills published yet. Publish one with publish_skill; they appear at ${configLink("/docs/team-setup/skills", await workspaceBase(apiClient2))}`
         );
       }
       return text(
@@ -4191,10 +4530,10 @@ Left out (hidden files are never part of a skill): ${skipped.join(", ")}` : "")
       title: "Install Skill",
       description: localFiles ? "Install a skill published to SystemDox onto this computer (default ~/.claude/skills/<name>/). Refuses, naming the files, when a file there was edited since it was installed, unless overwrite is true. Never runs anything." : "Fetch a skill published to SystemDox so you can install it: returns every file and the folder to write them into (default ~/.claude/skills/<name>/). Write each file exactly, then the manifest it shows.",
       inputSchema: {
-        name: z13.string().describe("The skill's name"),
-        version: z13.number().int().positive().optional().describe("A version number (default: the latest)"),
-        target: z13.string().optional().describe("Folder to install into, e.g. a repo's .claude/skills/<name>"),
-        ...localFiles ? { overwrite: z13.boolean().optional().describe("Replace files edited since they were installed") } : {}
+        name: z14.string().describe("The skill's name"),
+        version: z14.number().int().positive().optional().describe("A version number (default: the latest)"),
+        target: z14.string().optional().describe("Folder to install into, e.g. a repo's .claude/skills/<name>"),
+        ...localFiles ? { overwrite: z14.boolean().optional().describe("Replace files edited since they were installed") } : {}
       },
       annotations: { readOnlyHint: !localFiles }
     },
@@ -4249,22 +4588,22 @@ var init_skills2 = __esm({
 });
 
 // src/lib/team-setup-types.ts
-var PARTS, PERSON_ID_RE;
+var PARTS2, PERSON_ID_RE;
 var init_team_setup_types = __esm({
   "src/lib/team-setup-types.ts"() {
     "use strict";
     init_person_values();
-    PARTS = ["hooks", "mcp", "agents", "commands", "instructions"];
+    PARTS2 = ["hooks", "mcp", "agents", "commands", "instructions"];
     PERSON_ID_RE = new RegExp(`^${PERSON_ID}$`);
   }
 });
 
 // src/tools/team-setup.ts
-import { z as z14 } from "zod";
-import { existsSync as existsSync5 } from "fs";
+import { z as z15 } from "zod";
+import { existsSync as existsSync6 } from "fs";
 import { lstat as lstat2 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { join as join6, resolve as resolve7 } from "path";
+import { join as join7, resolve as resolve7 } from "path";
 function expandHome2(path) {
   return path.replace(/^~(?=$|[\\/])/, homedir4());
 }
@@ -4290,21 +4629,21 @@ async function readPartDirectory(part, directory) {
     let present = true;
     for (let i = 1; i <= segments.length; i++) {
       const rel = segments.slice(0, i).join("/");
-      if (await isLink(join6(root, ...segments.slice(0, i)))) {
+      if (await isLink(join7(root, ...segments.slice(0, i)))) {
         links.push(rel);
         present = false;
         break;
       }
     }
-    if (present && existsSync5(join6(root, ...segments))) paths.push(path);
+    if (present && existsSync6(join7(root, ...segments))) paths.push(path);
   }
   for (const { dir, md } of layout.folders) {
-    const full = join6(root, dir);
+    const full = join7(root, dir);
     if (await isLink(full)) {
       links.push(dir);
       continue;
     }
-    if (!existsSync5(full)) continue;
+    if (!existsSync6(full)) continue;
     const walked = await walk(full, { skipHidden: true });
     links.push(...walked.links.map((p) => `${dir}/${p}`));
     leftOut.push(...walked.hidden.map((p) => `${dir}/${p}`));
@@ -4344,9 +4683,9 @@ function describePerson(id, person) {
   return lines.join("\n");
 }
 function registerTeamSetupTools(server2, apiClient2, { localFiles }) {
-  const fileSchema = z14.object({
-    path: z14.string().describe(`Path inside the part's folder, forward slashes, e.g. "hooks/hooks.json"`),
-    content: z14.string().describe("The file's full text, exactly as it is")
+  const fileSchema = z15.object({
+    path: z15.string().describe(`Path inside the part's folder, forward slashes, e.g. "hooks/hooks.json"`),
+    content: z15.string().describe("The file's full text, exactly as it is")
   });
   server2.registerTool(
     "publish_setup_part",
@@ -4354,13 +4693,13 @@ function registerTeamSetupTools(server2, apiClient2, { localFiles }) {
       title: "Publish Setup Part",
       description: "Publish one part of your team's Claude Code setup to SystemDox: `hooks` (hooks/hooks.json and the scripts/ it calls), `mcp` (.mcp.json), `agents` (agents/*.md), `commands` (commands/*.md) or `instructions` (CLAUDE.md). Every part but instructions makes a new version of the team plugin, which each member accepts at their next update. Publishing hooks, mcp, agents or commands needs the admin role. " + (localFiles ? "Pass `directory`: the server reads only the files the part accepts, byte for byte, and refuses a link, a binary file or a file too large before anything is sent. Never retype the files into `files` when the folder is on this computer." : "Pass every file of the part in `files`, exactly as it is."),
       inputSchema: {
-        part: z14.enum(PARTS).describe("Which part of the setup"),
+        part: z15.enum(PARTS2).describe("Which part of the setup"),
         ...localFiles ? {
-          directory: z14.string().optional().describe(
+          directory: z15.string().optional().describe(
             "The folder on this computer: for hooks, the one holding hooks/hooks.json and scripts/; for mcp, the one holding .mcp.json; for instructions, the one holding CLAUDE.md; for agents or commands, the one holding agents/ or commands/"
           )
         } : {},
-        files: z14.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the part")
+        files: z15.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the part")
       },
       annotations: { readOnlyHint: false }
     },
@@ -4396,7 +4735,7 @@ function registerTeamSetupTools(server2, apiClient2, { localFiles }) {
       title: "Resolve Person",
       description: "Read back a person that a team memory names by identifier, written as `con_\u2026` (label), `ctc_\u2026` or `usr_\u2026`: their label, name, phone number and email address, from the vault that holds them. The details are for this session only: never write them into a memory file; the memory keeps the identifier. Writes nothing.",
       inputSchema: {
-        id: z14.string().regex(PERSON_ID_RE, "a con_, ctc_ or usr_ identifier, as written in the memory").describe("The identifier, e.g. con_01JC2Q8Y4M7T0X3K5N9P2R6S8V")
+        id: z15.string().regex(PERSON_ID_RE, "a con_, ctc_ or usr_ identifier, as written in the memory").describe("The identifier, e.g. con_01JC2Q8Y4M7T0X3K5N9P2R6S8V")
       },
       annotations: { readOnlyHint: true }
     },
@@ -4413,8 +4752,8 @@ function registerTeamSetupTools(server2, apiClient2, { localFiles }) {
       title: "Sync Memory",
       description: `Sync one project's team memory on this computer with SystemDox: pull the files the team changed, push the ones changed here, keep both texts of a file changed on both sides. It never answers for a person: a file that still holds a phone number, an email address or a home-folder path is skipped and listed, with the command for the member to run in their own terminal (\`${SYNC_MEMORY_COMMAND}\`). Pass dryRun to see what it would do without writing or sending anything.`,
       inputSchema: {
-        project: z14.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "a project name: lower case letters, digits and -").optional().describe("The project's team memory, e.g. puglieseweb-ltd; needed when the workspace has more than one"),
-        dryRun: z14.boolean().optional().describe("Show what would be pulled, pushed, deleted, conflicted and skipped, and change nothing")
+        project: z15.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "a project name: lower case letters, digits and -").optional().describe("The project's team memory, e.g. puglieseweb-ltd; needed when the workspace has more than one"),
+        dryRun: z15.boolean().optional().describe("Show what would be pulled, pushed, deleted, conflicted and skipped, and change nothing")
       },
       annotations: { readOnlyHint: false }
     },
@@ -4460,6 +4799,7 @@ function createServer(apiClient2, { localFiles = false } = {}) {
   registerGetTechStack(server2, apiClient2);
   registerGetPlanningContext(server2, apiClient2);
   registerGetPlanBoard(server2, apiClient2);
+  registerGetChange(server2, apiClient2);
   registerGetContext(server2, apiClient2);
   registerGetProjectRules(server2, apiClient2);
   registerGetPromptTemplates(server2, apiClient2);
@@ -4482,6 +4822,7 @@ var init_server = __esm({
     init_get_tech_stack();
     init_get_planning_context();
     init_get_plan_board();
+    init_get_change();
     init_get_context();
     init_create_guardrail();
     init_update_spec();
@@ -4492,7 +4833,7 @@ var init_server = __esm({
     init_create_prompt_template();
     init_skills2();
     init_team_setup();
-    SERVER_VERSION = true ? "0.1.47" : "0.0.0-dev";
+    SERVER_VERSION = true ? "0.1.49" : "0.0.0-dev";
   }
 });
 
@@ -4511,13 +4852,18 @@ async function main() {
 }
 var config, apiClient, server;
 var init_index = __esm({
-  "src/index.ts"() {
+  async "src/index.ts"() {
     "use strict";
-    init_config();
     init_api_client();
+    init_team_setup_files();
     init_server();
     init_server();
-    config = loadConfig();
+    try {
+      config = await loadLocalConfig();
+    } catch (err) {
+      console.error(`SystemDox MCP server: ${err.message}`);
+      process.exit(1);
+    }
     apiClient = new SystemDoxApiClient(config);
     server = createServer(apiClient, { localFiles: true });
     main();
@@ -4527,10 +4873,6 @@ var init_index = __esm({
 // src/cli.ts
 init_config();
 init_team_setup_files();
-import { readFile as readFile5, writeFile as writeFile6, chmod as chmod2 } from "fs/promises";
-import { existsSync as existsSync6 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
 import { createInterface } from "readline";
 function prompt(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -4541,158 +4883,10 @@ function prompt(question) {
     });
   });
 }
-async function validateApiKey(apiKey, apiUrl) {
-  try {
-    const res = await fetch(`${apiUrl.replace(/\/+$/, "")}/v1/health`, {
-      headers: {
-        Authorization: `Bearer ${apiKey}`,
-        "X-API-Key": apiKey,
-        Accept: "application/json"
-      }
-    });
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
-function findConfigTargets() {
-  const targets = [];
-  const projectMcp = join7(process.cwd(), ".mcp.json");
-  targets.push({
-    name: "Claude Code (project)",
-    path: projectMcp,
-    detected: true
-    // Always available
-  });
-  const claudeUser = join7(homedir5(), ".claude.json");
-  targets.push({
-    name: "Claude Code (user \u2014 all projects)",
-    path: claudeUser,
-    detected: true
-    // Always available
-  });
-  const cursorProject = join7(process.cwd(), ".cursor", "mcp.json");
-  const cursorDir = join7(process.cwd(), ".cursor");
-  targets.push({
-    name: "Cursor (project)",
-    path: cursorProject,
-    detected: existsSync6(cursorDir)
-  });
-  const vscodeProject = join7(process.cwd(), ".vscode", "mcp.json");
-  const vscodeDir = join7(process.cwd(), ".vscode");
-  targets.push({
-    name: "VS Code (project)",
-    path: vscodeProject,
-    detected: existsSync6(vscodeDir)
-  });
-  const cursorGlobal = join7(homedir5(), ".cursor", "mcp.json");
-  targets.push({
-    name: "Cursor (global)",
-    path: cursorGlobal,
-    detected: existsSync6(join7(homedir5(), ".cursor"))
-  });
-  return targets;
-}
-async function readOrCreateConfig(path) {
-  try {
-    const content = await readFile5(path, "utf-8");
-    return JSON.parse(content);
-  } catch {
-    return { mcpServers: {} };
-  }
-}
-async function writeConfig(path, config2) {
-  const dir = path.substring(0, path.lastIndexOf("/"));
-  if (!existsSync6(dir)) {
-    const { mkdir: mkdir6 } = await import("fs/promises");
-    await mkdir6(dir, { recursive: true });
-  }
-  await writeFile6(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
-  try {
-    await chmod2(path, 384);
-  } catch {
-  }
-}
-function serverEntry(apiKey, apiUrl) {
-  const entry = {
-    command: "npx",
-    args: ["@systemdox/mcp-server"],
-    env: {
-      SYSTEMDOX_API_KEY: apiKey
-    }
-  };
-  if (apiUrl !== API_URL_DEFAULT) {
-    entry.env.SYSTEMDOX_API_URL = apiUrl;
-  }
-  return entry;
-}
-async function setup() {
-  console.log("\n  SystemDox MCP Server Setup\n");
-  const apiKey = await prompt("  Enter your SystemDox API key: ");
-  if (!apiKey) {
-    console.error(
-      "\n  Error: API key is required.\n  Generate one at your SystemDox settings page.\n"
-    );
-    process.exit(1);
-  }
-  const apiUrlInput = await prompt(
-    `  API URL [${API_URL_DEFAULT}]: `
-  );
-  const apiUrl = apiUrlInput || API_URL_DEFAULT;
-  try {
-    requireHttpsApiUrl(apiUrl);
-  } catch (err) {
-    console.error(`
-  Error: ${err.message}
-`);
-    process.exit(1);
-  }
-  console.log("\n  Validating API key...");
-  const valid = await validateApiKey(apiKey, apiUrl);
-  if (!valid) {
-    console.error(
-      "\n  Error: Invalid API key or cannot reach the SystemDox API.\n  Check your key and try again.\n"
-    );
-    process.exit(1);
-  }
-  console.log("  API key validated successfully.\n");
-  const targets = findConfigTargets();
-  const detected = targets.filter((t) => t.detected);
-  console.log("  Available targets:");
-  detected.forEach((t, i) => {
-    console.log(`    ${i + 1}. ${t.name} (${t.path})`);
-  });
-  const choiceInput = await prompt(
-    `
-  Which target? [1-${detected.length}, or 'all']: `
-  );
-  let selected;
-  if (choiceInput.toLowerCase() === "all") {
-    selected = detected;
-  } else {
-    const idx = parseInt(choiceInput, 10) - 1;
-    if (isNaN(idx) || idx < 0 || idx >= detected.length) {
-      console.error("\n  Invalid selection.\n");
-      process.exit(1);
-    }
-    selected = [detected[idx]];
-  }
-  const entry = serverEntry(apiKey, apiUrl);
-  for (const target of selected) {
-    const config2 = await readOrCreateConfig(target.path);
-    config2.mcpServers["systemdox"] = entry;
-    await writeConfig(target.path, config2);
-    console.log(`  Configured: ${target.name}`);
-  }
-  console.log(
-    "\n  Done! Restart your AI coding tool to activate the SystemDox MCP server.\n  The server provides 20 tools: get_context, get_checks,\n  get_project_rules, get_prompt_templates, get_specs, get_docs,\n  get_tech_stack, get_planning_context, get_plan_board, create_check,\n  create_project_rule, create_prompt_template, update_spec,\n  report_decision, publish_skill, list_skills, install_skill,\n  publish_setup_part, resolve_person, sync_memory.\n\n  get_guardrails and create_guardrail remain registered as deprecated\n  aliases of get_checks and create_check \u2014 existing configs keep working.\n"
-  );
-  return { apiKey, apiUrl };
-}
 var args = process.argv.slice(2);
 var command = args[0];
 if (command === "setup") {
-  Promise.resolve().then(() => (init_setup_team(), setup_team_exports)).then(async ({ parseSetupArgs: parseSetupArgs2, runTeamSetupCommand: runTeamSetupCommand2 }) => {
+  Promise.all([Promise.resolve().then(() => (init_setup_team(), setup_team_exports)), Promise.resolve().then(() => (init_setup_mcp(), setup_mcp_exports))]).then(async ([{ parseSetupArgs: parseSetupArgs2, runTeamSetupCommand: runTeamSetupCommand2 }, { setupMcpServer: setupMcpServer2 }]) => {
     let teamArgs;
     try {
       teamArgs = parseSetupArgs2(args.slice(1));
@@ -4702,8 +4896,13 @@ if (command === "setup") {
 `);
       process.exit(1);
     }
-    const key = await setup();
-    return runTeamSetupCommand2(teamArgs, key, {
+    const step = await setupMcpServer2({
+      out: console.log,
+      err: console.error,
+      ask: (question) => prompt(question)
+    });
+    if (step.code !== 0) return step.code;
+    return runTeamSetupCommand2(teamArgs, step, {
       out: console.log,
       ask: (question) => prompt(question),
       terminal: !!process.stdin.isTTY
@@ -4763,15 +4962,18 @@ if (command === "setup") {
     systemdox-mcp-server --help   Show this help message
 
   Environment variables:
-    SYSTEMDOX_API_KEY             Your SystemDox API key (required; plugin-path and
-                                  marketplace-auth also read
-                                  ~/.claude/systemdox/credentials.json)
+    SYSTEMDOX_API_KEY             Your SystemDox API key. When it is not set, every
+                                  command reads ~/.claude/systemdox/credentials.json,
+                                  where setup stores the key (and nowhere else: not
+                                  in your AI tool's MCP config)
+    SYSTEMDOX_WORKSPACE           The workspace whose key to use when
+                                  credentials.json holds several
     SYSTEMDOX_API_URL             API URL (default: ${API_URL_DEFAULT})
     SYSTEMDOX_CACHE_TTL           Cache TTL in seconds (default: 300)
     SYSTEMDOX_DEFAULT_ORG         Default GitHub org
 `);
 } else if (!command) {
-  Promise.resolve().then(() => init_index());
+  init_index();
 } else {
   console.error(`  Unknown command: ${command}
   Run 'systemdox-mcp-server --help' for usage.`);