@systemdox/mcp-server 0.1.49 → 0.1.50

package/dist/http.js

@@ -63,14 +63,6 @@ var SystemDoxApiClient = class {
     this.config = config;
     this.cache = new ResponseCache(config.cacheTtlMs);
   }
-  async validate() {
-    const res = await this.fetchRaw("/v1/health");
-    if (!res.ok) {
-      throw new Error(
-        `SystemDox API authentication failed (${res.status}). Check your SYSTEMDOX_API_KEY.`
-      );
-    }
-  }
   async get(path, params) {
     const url = this.buildUrl(path, params);
     const cacheKey = url.toString();
@@ -84,8 +76,8 @@ var SystemDoxApiClient = class {
   }
   /** A read that skips the cache: an install must take the version that is
    * latest now, not the one cached before someone published another. */
-  async getFresh(path) {
-    const res = await this.fetchRaw(path);
+  async getFresh(path, signal) {
+    const res = await this.fetchRaw(path, void 0, signal);
     if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
     return await res.json();
   }
@@ -115,8 +107,8 @@ var SystemDoxApiClient = class {
   // One method per operationId. Every read skips the cache: setup, sync and
   // plugin-path act on what the workspace holds now.
   /** getOwnTeamSetup: the key's own workspace, named in `workspace`. */
-  getOwnTeamSetup() {
-    return this.getFresh(TEAM_SETUP);
+  getOwnTeamSetup(signal) {
+    return this.getFresh(TEAM_SETUP, signal);
   }
   getTeamSetup(workspace) {
     return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}`);
@@ -220,14 +212,15 @@ var SystemDoxApiClient = class {
     }
     return url;
   }
-  async fetchRaw(path, params) {
+  async fetchRaw(path, params, signal) {
     const url = this.buildUrl(path, params);
     return fetch(url, {
       headers: {
         Authorization: `Bearer ${this.config.apiKey}`,
         "X-API-Key": this.config.apiKey,
         Accept: "application/json"
-      }
+      },
+      signal
     });
   }
 };
@@ -286,149 +279,530 @@ function emitMcpToolCalls(tenant, rawBody, log = console.log) {
   }
 }
 
-// src/server.ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-
-// src/tools/get-guardrails.ts
-import { z } from "zod";
+// src/lib/session-brief.ts
+import { existsSync as existsSync2 } from "fs";
+import { readFile as readFile3 } from "fs/promises";
+import { join as join3 } from "path";
 
-// src/lib/language.ts
-var EXTENSION_MAP = {
-  ".py": { language: "python", categories: ["api", "backend", "data-access"] },
-  ".ts": { language: "typescript", categories: ["frontend", "api"] },
-  ".tsx": { language: "typescript", categories: ["frontend"] },
-  ".js": { language: "javascript", categories: ["frontend"] },
-  ".jsx": { language: "javascript", categories: ["frontend"] },
-  ".yaml": {
-    language: "cloudformation",
-    categories: ["infrastructure", "architecture"]
-  },
-  ".yml": {
-    language: "cloudformation",
-    categories: ["infrastructure", "architecture"]
-  },
-  ".json": { language: "json", categories: ["configuration"] },
-  ".css": { language: "css", categories: ["frontend"] },
-  ".html": { language: "html", categories: ["frontend"] },
-  ".sql": { language: "sql", categories: ["data-access"] },
-  ".sh": { language: "shell", categories: ["infrastructure"] },
-  ".bash": { language: "shell", categories: ["infrastructure"] },
-  ".tf": { language: "terraform", categories: ["infrastructure"] },
-  ".md": { language: "markdown", categories: ["documentation"] }
+// src/lib/skills.ts
+import { createHash } from "crypto";
+import { lstat, mkdir, readdir, readFile, rm, writeFile } from "fs/promises";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { dirname, join, relative, resolve, sep } from "path";
+var MANIFEST_FILE = ".systemdox-skill.json";
+var ENTRY_FILE = "SKILL.md";
+var PLUGIN_MANIFEST_FOLDER = ".claude-plugin";
+var MAX_FILES = 100;
+var MAX_FILE_BYTES = 256 * 1024;
+var MAX_TOTAL_BYTES = 1024 * 1024;
+var NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var SEGMENT_RE = /^[A-Za-z0-9._-]+$/;
+var SKIPPED = /* @__PURE__ */ new Set([MANIFEST_FILE, ".git", "node_modules", "__pycache__", ".DS_Store"]);
+var SkillInstallRefused = class extends Error {
+  constructor(dest, edited) {
+    super(
+      `${dest} has local changes in ${edited.length} file(s): ${edited.join(", ")}. Nothing was written. Move your changes aside, or install again with overwrite.`
+    );
+    this.dest = dest;
+    this.edited = edited;
+  }
+  dest;
+  edited;
 };
-var PATH_CATEGORY_RULES = [
-  { pattern: /backend\/functions\//, categories: ["api", "backend"] },
-  { pattern: /backend\/layers\//, categories: ["backend"] },
-  { pattern: /backend\//, categories: ["backend"] },
-  { pattern: /apps\/app\//, categories: ["frontend"] },
-  { pattern: /apps\/website\//, categories: ["frontend"] },
-  { pattern: /apps\/portal\//, categories: ["frontend"] },
-  { pattern: /packages\/ui\//, categories: ["frontend"] },
-  { pattern: /infra\//, categories: ["infrastructure"] },
-  { pattern: /\.github\//, categories: ["infrastructure"] },
-  { pattern: /tests?\//, categories: ["testing"] },
-  { pattern: /spec/, categories: ["testing"] },
-  { pattern: /docs\/adr/, categories: ["architecture"] },
-  { pattern: /template\.yaml$/, categories: ["infrastructure", "architecture"] }
-];
-function detectLanguage(filePath) {
-  const ext = filePath.slice(filePath.lastIndexOf("."));
-  return EXTENSION_MAP[ext];
+function sha256(content) {
+  return createHash("sha256").update(content, "utf8").digest("hex");
 }
-function detectCategories(filePaths) {
-  const categories = /* @__PURE__ */ new Set();
-  for (const filePath of filePaths) {
-    const langInfo = detectLanguage(filePath);
-    if (langInfo) {
-      for (const cat of langInfo.categories) {
-        categories.add(cat);
-      }
+function isValidName(name) {
+  return name.length <= 64 && NAME_RE.test(name);
+}
+function isValidPath(path) {
+  return path.length > 0 && path.length <= 512 && !path.startsWith("/") && path.split("/").every((s) => SEGMENT_RE.test(s) && s !== "." && s !== ".." && s !== PLUGIN_MANIFEST_FOLDER);
+}
+function frontmatterName(skillMd) {
+  const block = /^---\r?\n([\s\S]*?)\r?\n---/.exec(skillMd);
+  if (!block) return void 0;
+  const line = /^name:[ \t]*(.+?)[ \t]*$/m.exec(block[1]);
+  return line ? line[1].replace(/^(['"])(.*)\1$/, "$2") : void 0;
+}
+function defaultSkillDir(name) {
+  return join(homedir(), ".claude", "skills", name);
+}
+async function walk(root, { skipHidden }, dir = root, out = { files: [], links: [], hidden: [] }) {
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    if (SKIPPED.has(entry.name) || entry.name.endsWith(".pyc")) continue;
+    const full = join(dir, entry.name);
+    const rel = relative(root, full).split(sep).join("/");
+    if (entry.isSymbolicLink()) out.links.push(rel);
+    else if (skipHidden && entry.name.startsWith(".")) out.hidden.push(rel);
+    else if (entry.isDirectory()) await walk(root, { skipHidden }, full, out);
+    else if (entry.isFile()) out.files.push(rel);
+  }
+  out.files.sort();
+  return out;
+}
+async function readTextFiles(root, paths, what) {
+  if (paths.length > MAX_FILES) {
+    throw new Error(`${root} holds ${paths.length} files: ${what} holds at most ${MAX_FILES}`);
+  }
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  const files = [];
+  let total = 0;
+  for (const path of paths) {
+    if (!isValidPath(path)) {
+      throw new Error(`${path}: file names may use letters, digits, ".", "_" and "-" only`);
     }
-    for (const rule of PATH_CATEGORY_RULES) {
-      if (rule.pattern.test(filePath)) {
-        for (const cat of rule.categories) {
-          categories.add(cat);
-        }
-      }
+    const raw = await readFile(join(root, ...path.split("/")));
+    if (raw.includes(0)) throw new Error(`${path} is binary: ${what} holds text files only`);
+    if (raw.length > MAX_FILE_BYTES) {
+      throw new Error(`${path} is ${raw.length} bytes: a file holds at most ${MAX_FILE_BYTES}`);
+    }
+    total += raw.length;
+    if (total > MAX_TOTAL_BYTES) {
+      throw new Error(`the files pass ${MAX_TOTAL_BYTES} bytes at ${path}`);
+    }
+    let content;
+    try {
+      content = decoder.decode(raw);
+    } catch {
+      throw new Error(`${path} is not UTF-8 text`);
     }
+    files.push({ path, content });
   }
-  return Array.from(categories);
+  return files;
 }
-function detectLanguages(filePaths) {
-  const languages = /* @__PURE__ */ new Set();
-  for (const filePath of filePaths) {
-    const info = detectLanguage(filePath);
-    if (info) languages.add(info.language);
+async function readSkillDirectory(directory) {
+  const root = resolve(directory);
+  if (!existsSync(join(root, ENTRY_FILE))) {
+    throw new Error(`${root} has no ${ENTRY_FILE}: a skill folder holds SKILL.md at its root`);
   }
-  return Array.from(languages);
+  const walked = await walk(root, { skipHidden: true });
+  if (walked.links.length) {
+    throw new Error(`${walked.links.join(", ")}: links are not followed; copy the file into the skill folder`);
+  }
+  const files = await readTextFiles(root, walked.files, "a skill");
+  const skillMd = files.find((f) => f.path === ENTRY_FILE);
+  const name = frontmatterName(skillMd.content);
+  if (!name) throw new Error(`${ENTRY_FILE} has no frontmatter name`);
+  return { name, files, skipped: walked.hidden };
 }
-
-// src/lib/deprecation.ts
-var LEGACY_TOOL_REMOVAL_EARLIEST = "2027-01-31";
-function legacyToolDescription(canonical, description) {
-  return `DEPRECATED \u2014 use \`${canonical}\` instead. This name still works and will not be removed before ${LEGACY_TOOL_REMOVAL_EARLIEST}. ${description}`;
+function within(dest, path) {
+  if (!isValidPath(path)) throw new Error(`refusing to write ${JSON.stringify(path)}: not a skill path`);
+  const full = resolve(dest, ...path.split("/"));
+  if (!full.startsWith(resolve(dest) + sep)) throw new Error(`refusing to write outside ${dest}: ${path}`);
+  return full;
 }
-
-// src/lib/config-links.ts
-async function workspaceBase(apiClient) {
+async function readManifest(dest) {
   try {
-    const access = await apiClient.get(
-      "/v1/docs/portal-access"
-    );
-    const slug = (access.host ?? "").split(".")[0];
-    return slug ? `https://${slug}.systemdox.com` : null;
+    return JSON.parse(await readFile(join(dest, MANIFEST_FILE), "utf8"));
   } catch {
-    return null;
+    return void 0;
   }
 }
-function configLink(path, base) {
-  return base ? `${base}${path}` : `${path} in your SystemDox workspace`;
-}
-
-// src/tools/get-guardrails.ts
-var DESCRIPTION = "Retrieve SystemDox checks (banned patterns, required patterns, coding rules). Filter by language, category, or file path to get only relevant checks.";
-var inputSchema = () => ({
-  language: z.string().optional().describe(
-    "Filter by programming language (python, typescript, javascript, cloudformation)"
-  ),
-  category: z.string().optional().describe(
-    "Filter by category (imports, auth, error-handling, architecture, testing, security, conventions, data-access)"
-  ),
-  file_path: z.string().optional().describe(
-    "File path being edited \u2014 language is auto-detected from the extension"
-  )
-});
-function registerGetGuardrails(server, apiClient) {
-  const handler2 = async ({
-    language,
-    category,
-    file_path
-  }) => {
-    const guardrails = await apiClient.get("/v1/guardrails");
-    let filtered = guardrails;
-    const lang = language ?? (file_path ? detectLanguage(file_path)?.language : void 0);
-    if (lang) {
-      filtered = filtered.filter(
-        (g) => g.description.toLowerCase().includes(lang.toLowerCase()) || g.category.toLowerCase().includes(lang.toLowerCase()) || g.title.toLowerCase().includes(lang.toLowerCase())
-      );
-    }
-    if (category) {
-      filtered = filtered.filter(
-        (g) => g.category.toLowerCase() === category.toLowerCase()
-      );
-    }
-    if (filtered.length === 0) {
-      const text4 = guardrails.length === 0 ? `No checks found. Add checks at ${configLink("/docs/guardrails", await workspaceBase(apiClient))}` : `No checks found${lang ? ` for language "${lang}"` : ""}${category ? ` in category "${category}"` : ""}.`;
-      return {
-        content: [{ type: "text", text: text4 }]
-      };
+async function installSkill(version, dest, { overwrite = false } = {}) {
+  if (!isValidName(version.name)) throw new Error(`refusing to install ${JSON.stringify(version.name)}: not a skill name`);
+  const incoming = new Map(version.files.map((f) => [f.path, f]));
+  for (const f of version.files) within(dest, f.path);
+  if (existsSync(dest) && (await lstat(dest)).isSymbolicLink()) {
+    throw new Error(`${dest} is a link: install into a real folder`);
+  }
+  const walked = existsSync(dest) ? await walk(dest, { skipHidden: false }) : { files: [], links: [], hidden: [] };
+  if (walked.links.length) {
+    throw new Error(`${dest} holds links (${walked.links.join(", ")}): remove them, nothing was written`);
+  }
+  const present = walked.files;
+  const manifest = await readManifest(dest);
+  const known2 = Object.fromEntries(
+    Object.entries(manifest?.files ?? {}).filter(([p, h]) => isValidPath(p) && typeof h === "string")
+  );
+  const edited = [];
+  const untracked = [];
+  for (const path of present) {
+    const content = await readFile(join(dest, ...path.split("/")), "utf8");
+    if (Object.hasOwn(known2, path)) {
+      if (sha256(content) !== known2[path]) edited.push(path);
+    } else if (!incoming.has(path) || sha256(content) !== incoming.get(path).sha256) {
+      if (incoming.has(path) || !manifest) edited.push(path);
+      else untracked.push(path);
     }
-    const text3 = filtered.map(
-      (g) => `## ${g.title} [${g.severity}]
-
-${g.description}
-
-` + (g.pattern ? `**Bad pattern:**
+  }
+  const blocking = edited.filter((p) => incoming.has(p) || !manifest);
+  if (blocking.length && !overwrite) throw new SkillInstallRefused(dest, blocking);
+  const written = [];
+  for (const f of version.files) {
+    const full = within(dest, f.path);
+    await mkdir(dirname(full), { recursive: true });
+    await writeFile(full, f.content, "utf8");
+    written.push(f.path);
+  }
+  const removed = [];
+  const keptEdited = [];
+  for (const path of Object.keys(known2)) {
+    if (incoming.has(path) || !present.includes(path)) continue;
+    if (edited.includes(path)) {
+      keptEdited.push(path);
+      continue;
+    }
+    await rm(within(dest, path));
+    removed.push(path);
+  }
+  const next = {
+    name: version.name,
+    version: version.version,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    files: Object.fromEntries(version.files.map((f) => [f.path, f.sha256]))
+  };
+  await writeFile(join(dest, MANIFEST_FILE), JSON.stringify(next, null, 2) + "\n", "utf8");
+  return {
+    dest,
+    version: version.version,
+    written,
+    removed,
+    keptUntracked: untracked.filter((p) => !incoming.has(p)),
+    keptEdited
+  };
+}
+function fenceFor(text3) {
+  const longest = Math.max(0, ...(text3.match(/`+/g) ?? []).map((r) => r.length));
+  return "`".repeat(Math.max(3, longest + 1));
+}
+function describeInstall(name, r) {
+  const lines = [
+    `Installed ${name} version ${r.version} into ${r.dest} (${r.written.length} file(s)).`
+  ];
+  if (r.removed.length) lines.push(`Removed (no longer in the skill): ${r.removed.join(", ")}`);
+  if (r.keptEdited.length) {
+    lines.push(`Kept, edited here and no longer in the skill: ${r.keptEdited.join(", ")}`);
+  }
+  if (r.keptUntracked.length) lines.push(`Kept, added here: ${r.keptUntracked.join(", ")}`);
+  lines.push("Start a new Claude Code session to load it.");
+  return lines.join("\n");
+}
+
+// src/lib/team-setup-files.ts
+import { execFile } from "child_process";
+import { chmod, mkdir as mkdir2, readFile as readFile2, rename, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir2, userInfo } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+import { promisify } from "util";
+var SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function isWorkspace(value) {
+  return typeof value === "string" && value.length <= 64 && SLUG_RE.test(value);
+}
+function homeDir() {
+  return homedir2();
+}
+function systemdoxDir() {
+  return join2(homeDir(), ".claude", "systemdox");
+}
+function workspaceDir(workspace) {
+  if (!isWorkspace(workspace)) throw new Error(`${JSON.stringify(workspace)} is not a workspace name`);
+  return join2(systemdoxDir(), workspace);
+}
+function statePath(workspace) {
+  return join2(workspaceDir(workspace), "state.json");
+}
+async function readJson(path, empty) {
+  let text3;
+  try {
+    text3 = await readFile2(path, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return empty;
+    throw e;
+  }
+  try {
+    return JSON.parse(text3);
+  } catch {
+    throw new Error(`${path} is not valid JSON: fix or remove it, then run this again`);
+  }
+}
+async function writeJsonAtomically(path, value, mode) {
+  await mkdir2(dirname2(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  await writeFile2(tmp, JSON.stringify(value, null, 2) + "\n", mode === void 0 ? "utf8" : { encoding: "utf8", mode });
+  await rename(tmp, path);
+}
+var run = promisify(execFile);
+async function readState(workspace) {
+  return readJson(statePath(workspace), {});
+}
+async function writeState(workspace, state) {
+  await writeJsonAtomically(statePath(workspace), state);
+}
+async function updateState(workspace, change) {
+  const state = await readState(workspace);
+  change(state);
+  await writeState(workspace, state);
+  return state;
+}
+
+// src/lib/session-brief.ts
+var INSTRUCTIONS_MAX = 2e3;
+var BRIEF_TIMEOUT_MS = 8e3;
+var SETUP_COMMAND = "npx -y @systemdox/mcp-server setup";
+var REFUSED = `SystemDox refused this computer's key, so the team's rules and skills cannot be read and every SystemDox tool fails. Tell the person once: a new key comes from the SystemDox console, Settings \u203A API keys, and \`${SETUP_COMMAND}\` in their own terminal stores it.`;
+var NOT_CHECKED = "SystemDox could not be read when this session started, so the team's skills were not checked. Call get_team_setup to check again before relying on them.";
+var CANNOT_SEE = "This server cannot see this computer's disk. For each skill listed under Team skills: if ~/.claude/skills/<name>/ is absent, or its .systemdox-skill.json names another version than get_team_setup lists, call install_skill with that version and write what it returns, unless the latest team plugin carries it. Leave a folder with no such file alone. If a file there differs from the hash that file holds for it, it was edited: ask the person before replacing it.";
+function noKey(reason) {
+  return `This computer has no SystemDox key it can use (${reason}), so the team's rules and skills cannot be read and every SystemDox tool fails. Tell the person once: \`${SETUP_COMMAND}\` in their own terminal asks for one.`;
+}
+function olderApi(setup) {
+  return `SystemDox workspace ${setup.workspace}. Before writing code in one of its repositories, call get_context with the task and the files you expect to touch, and obey what it returns. get_team_setup lists the team setup.`;
+}
+async function readJsonQuietly(path) {
+  try {
+    return JSON.parse(await readFile3(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function computerState(setup) {
+  const id = `${setup.workspace}-setup@systemdox-${setup.workspace}`;
+  const installed = await readJsonQuietly(join3(homeDir(), ".claude", "plugins", "installed_plugins.json"));
+  const entries2 = installed?.plugins?.[id];
+  const entry = Array.isArray(entries2) ? entries2.find((e) => (e?.scope ?? "user") === "user") : void 0;
+  const state = {
+    missing: [],
+    behind: [],
+    notFromSystemDox: [],
+    pluginInstalled: !!entry,
+    pluginVersion: entry?.version
+  };
+  const pluginCurrent = !!entry && !!setup.plugin && entry.version === `${setup.plugin.version}.0.0`;
+  for (const skill of setup.sessionBrief?.skills ?? []) {
+    const dir = defaultSkillDir(skill.name);
+    if (!existsSync2(dir)) {
+      if (!(pluginCurrent && setup.plugin?.skills?.[skill.name] !== void 0)) state.missing.push(skill.name);
+      continue;
+    }
+    const manifest = await readJsonQuietly(join3(dir, MANIFEST_FILE));
+    if (typeof manifest?.version !== "number" || !Number.isInteger(manifest.version)) {
+      state.notFromSystemDox.push(skill.name);
+    } else if (manifest.version !== skill.latestVersion) {
+      state.behind.push({ name: skill.name, here: manifest.version, latest: skill.latestVersion });
+    }
+  }
+  return state;
+}
+function hasPersonParts(setup) {
+  return Object.keys(setup.parts ?? {}).length > 0 || (setup.memory ?? []).length > 0 || (setup.sessionBrief?.heldSkills ?? []).some((h) => h.reason === "not-plain");
+}
+var MORE = (n) => `${n} more (get_team_setup lists them)`;
+var LIST_MIN = `all ${MORE(100)}`.length;
+function listWithin(items, room) {
+  const whole2 = items.join(", ");
+  if (whole2.length <= room) return whole2;
+  const kept = [];
+  let used = 0;
+  for (let i = 0; i < items.length; i++) {
+    const rest = items.length - i - 1;
+    const cost = items[i].length + (kept.length ? 2 : 0);
+    if (used + cost + ` and ${MORE(rest)}`.length > room) break;
+    kept.push(items[i]);
+    used += cost;
+  }
+  return kept.length ? `${kept.join(", ")} and ${MORE(items.length - kept.length)}` : `all ${MORE(items.length)}`;
+}
+function localSection(setup, state, room) {
+  const rest = hasPersonParts(setup) ? ` and that \`${SETUP_COMMAND}\` in their own terminal adds the rest of the team setup` : "";
+  const latest = new Map((setup.sessionBrief?.skills ?? []).map((s) => [s.name, s.latestVersion]));
+  const lines = [];
+  if (state.missing.length) {
+    lines.push({
+      head: "On this computer, missing: ",
+      items: state.missing.map((name) => `${name} version ${latest.get(name)}`),
+      tail: `. Install each now with install_skill at that version, before your first answer. Then tell the person what you installed${rest}. When a skill's line matches the request and it is not loaded yet, read ~/.claude/skills/<name>/SKILL.md and follow it.`
+    });
+  }
+  if (state.behind.length) {
+    lines.push({
+      head: "On this computer, behind: ",
+      items: state.behind.map((b) => `${b.name} (version ${b.here} here, latest ${b.latest})`),
+      tail: ". install_skill updates each to that latest version; if it refuses because files were edited, tell the person and leave them."
+    });
+  }
+  if (state.notFromSystemDox.length) {
+    lines.push({ head: "Not from SystemDox, left alone: ", items: state.notFromSystemDox, tail: "." });
+  }
+  const fixed = () => lines.reduce((n, l) => n + l.head.length + l.tail.length + LIST_MIN, 0) + Math.max(0, lines.length - 1);
+  while (lines.length && fixed() > room) lines.pop();
+  if (!lines.length) return "";
+  const share = Math.floor((room - fixed()) / lines.length) + LIST_MIN;
+  return lines.map((l) => `${l.head}${listWithin(l.items, share)}${l.tail}`).join("\n");
+}
+function fit(text3, section) {
+  const whole2 = section ? `${text3}
+
+${section}` : text3;
+  if (whole2.length <= INSTRUCTIONS_MAX) return whole2;
+  return text3.length <= INSTRUCTIONS_MAX ? text3 : `${text3.slice(0, INSTRUCTIONS_MAX - 1)}\u2026`;
+}
+async function readTeamSetup(apiClient, { keyProblem, timeoutMs = BRIEF_TIMEOUT_MS } = {}) {
+  if (keyProblem) return { problem: noKey(keyProblem) };
+  try {
+    const setup = await apiClient.getOwnTeamSetup(AbortSignal.timeout(timeoutMs));
+    return typeof setup?.workspace === "string" ? { setup } : { problem: NOT_CHECKED };
+  } catch (err) {
+    const status = err?.status;
+    return { problem: status === 401 || status === 403 ? REFUSED : NOT_CHECKED };
+  }
+}
+async function sessionInstructions(apiClient, options = {}) {
+  const read = await readTeamSetup(apiClient, options);
+  if ("problem" in read) return read.problem;
+  const text3 = read.setup.sessionBrief?.text ?? olderApi(read.setup);
+  try {
+    if (!options.localFiles) return fit(text3, read.setup.sessionBrief?.skills?.length ? CANNOT_SEE : "");
+    const room = INSTRUCTIONS_MAX - text3.length - 2;
+    return fit(text3, localSection(read.setup, await computerState(read.setup), room));
+  } catch {
+    return fit(text3, "");
+  }
+}
+
+// src/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// src/tools/get-guardrails.ts
+import { z } from "zod";
+
+// src/lib/language.ts
+var EXTENSION_MAP = {
+  ".py": { language: "python", categories: ["api", "backend", "data-access"] },
+  ".ts": { language: "typescript", categories: ["frontend", "api"] },
+  ".tsx": { language: "typescript", categories: ["frontend"] },
+  ".js": { language: "javascript", categories: ["frontend"] },
+  ".jsx": { language: "javascript", categories: ["frontend"] },
+  ".yaml": {
+    language: "cloudformation",
+    categories: ["infrastructure", "architecture"]
+  },
+  ".yml": {
+    language: "cloudformation",
+    categories: ["infrastructure", "architecture"]
+  },
+  ".json": { language: "json", categories: ["configuration"] },
+  ".css": { language: "css", categories: ["frontend"] },
+  ".html": { language: "html", categories: ["frontend"] },
+  ".sql": { language: "sql", categories: ["data-access"] },
+  ".sh": { language: "shell", categories: ["infrastructure"] },
+  ".bash": { language: "shell", categories: ["infrastructure"] },
+  ".tf": { language: "terraform", categories: ["infrastructure"] },
+  ".md": { language: "markdown", categories: ["documentation"] }
+};
+var PATH_CATEGORY_RULES = [
+  { pattern: /backend\/functions\//, categories: ["api", "backend"] },
+  { pattern: /backend\/layers\//, categories: ["backend"] },
+  { pattern: /backend\//, categories: ["backend"] },
+  { pattern: /apps\/app\//, categories: ["frontend"] },
+  { pattern: /apps\/website\//, categories: ["frontend"] },
+  { pattern: /apps\/portal\//, categories: ["frontend"] },
+  { pattern: /packages\/ui\//, categories: ["frontend"] },
+  { pattern: /infra\//, categories: ["infrastructure"] },
+  { pattern: /\.github\//, categories: ["infrastructure"] },
+  { pattern: /tests?\//, categories: ["testing"] },
+  { pattern: /spec/, categories: ["testing"] },
+  { pattern: /docs\/adr/, categories: ["architecture"] },
+  { pattern: /template\.yaml$/, categories: ["infrastructure", "architecture"] }
+];
+function detectLanguage(filePath) {
+  const ext = filePath.slice(filePath.lastIndexOf("."));
+  return EXTENSION_MAP[ext];
+}
+function detectCategories(filePaths) {
+  const categories = /* @__PURE__ */ new Set();
+  for (const filePath of filePaths) {
+    const langInfo = detectLanguage(filePath);
+    if (langInfo) {
+      for (const cat of langInfo.categories) {
+        categories.add(cat);
+      }
+    }
+    for (const rule of PATH_CATEGORY_RULES) {
+      if (rule.pattern.test(filePath)) {
+        for (const cat of rule.categories) {
+          categories.add(cat);
+        }
+      }
+    }
+  }
+  return Array.from(categories);
+}
+function detectLanguages(filePaths) {
+  const languages = /* @__PURE__ */ new Set();
+  for (const filePath of filePaths) {
+    const info = detectLanguage(filePath);
+    if (info) languages.add(info.language);
+  }
+  return Array.from(languages);
+}
+
+// src/lib/deprecation.ts
+var LEGACY_TOOL_REMOVAL_EARLIEST = "2027-01-31";
+function legacyToolDescription(canonical, description) {
+  return `DEPRECATED \u2014 use \`${canonical}\` instead. This name still works and will not be removed before ${LEGACY_TOOL_REMOVAL_EARLIEST}. ${description}`;
+}
+
+// src/lib/config-links.ts
+async function workspaceBase(apiClient) {
+  try {
+    const access = await apiClient.get(
+      "/v1/docs/portal-access"
+    );
+    const slug = (access.host ?? "").split(".")[0];
+    return slug ? `https://${slug}.systemdox.com` : null;
+  } catch {
+    return null;
+  }
+}
+function configLink(path, base) {
+  return base ? `${base}${path}` : `${path} in your SystemDox workspace`;
+}
+
+// src/tools/get-guardrails.ts
+var DESCRIPTION = "Retrieve SystemDox checks (banned patterns, required patterns, coding rules). Filter by language, category, or file path to get only relevant checks.";
+var inputSchema = () => ({
+  language: z.string().optional().describe(
+    "Filter by programming language (python, typescript, javascript, cloudformation)"
+  ),
+  category: z.string().optional().describe(
+    "Filter by category (imports, auth, error-handling, architecture, testing, security, conventions, data-access)"
+  ),
+  file_path: z.string().optional().describe(
+    "File path being edited \u2014 language is auto-detected from the extension"
+  )
+});
+function registerGetGuardrails(server, apiClient) {
+  const handler2 = async ({
+    language,
+    category,
+    file_path
+  }) => {
+    const guardrails = await apiClient.get("/v1/guardrails");
+    let filtered = guardrails;
+    const lang = language ?? (file_path ? detectLanguage(file_path)?.language : void 0);
+    if (lang) {
+      filtered = filtered.filter(
+        (g) => g.description.toLowerCase().includes(lang.toLowerCase()) || g.category.toLowerCase().includes(lang.toLowerCase()) || g.title.toLowerCase().includes(lang.toLowerCase())
+      );
+    }
+    if (category) {
+      filtered = filtered.filter(
+        (g) => g.category.toLowerCase() === category.toLowerCase()
+      );
+    }
+    if (filtered.length === 0) {
+      const text4 = guardrails.length === 0 ? `No checks found. Add checks at ${configLink("/docs/guardrails", await workspaceBase(apiClient))}` : `No checks found${lang ? ` for language "${lang}"` : ""}${category ? ` in category "${category}"` : ""}.`;
+      return {
+        content: [{ type: "text", text: text4 }]
+      };
+    }
+    const text3 = filtered.map(
+      (g) => `## ${g.title} [${g.severity}]
+
+${g.description}
+
+` + (g.pattern ? `**Bad pattern:**
 \`\`\`
 ${g.pattern}
 \`\`\`
@@ -744,7 +1118,7 @@ ${r.conventions.map((c) => `- ${c}`).join("\n")}` : "")
 ${repos}`);
       }
       if (ctx.dependencies.length > 0) {
-        const deps = ctx.dependencies.map((d) => `- ${d.from} \u2192 ${d.to}`).join("\n");
+        const deps = ctx.dependencies.map((d) => `- ${d.from} \u2192 ${d.to}${d.provenance === "inferred" ? " (inferred)" : ""}`).join("\n");
         sections.push(`## Cross-Repo Dependencies
 
 ${deps}`);
@@ -972,7 +1346,7 @@ ${notes.join("\n")}` : "")
 import { z as z6 } from "zod";
 var GITHUB_NAME = "[A-Za-z0-9][A-Za-z0-9._-]{0,99}";
 var REPO_RE = new RegExp(`^${GITHUB_NAME}/${GITHUB_NAME}$`);
-var SLUG_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var SLUG_RE2 = /^[a-z0-9]+(-[a-z0-9]+)*$/;
 var SLUG_MAX = 64;
 var PARTS = ["decision", "contract", "behaviour", "plan", "release"];
 var BRIEF = ["decision", "contract", "behaviour", "plan"];
@@ -1084,7 +1458,7 @@ function registerGetChange(server, apiClient) {
       description: `Read one change (a specs/changes/<slug>/ folder of a connected repository) as SystemDox last synced it from GitHub: the state of each part of its brief (decision, contract, behaviour, plan) and of its release, each with its pull request; the decision's ADR and status; the contract files; every feature file that names the change, with its scenarios as id \xB7 state \xB7 title; the plan (plan.md, the draft, the board); the release pull requests; and the Change object as JSON. The last line says "The brief is passed" or "The brief is not passed: <part> is <state>". Call it before building a story, and stop if the brief is not passed or the story's scenarios are not proposed. Read-only.`,
       inputSchema: {
         repo: z6.string().regex(REPO_RE, "the repository as owner/name, e.g. acme/booking-api").describe("The repository that holds the change, as owner/name"),
-        slug: z6.string().max(SLUG_MAX).regex(SLUG_RE, "a change folder's name: lower-case words joined by -, e.g. customer-reminders").describe("The change's folder name: specs/changes/<slug>/")
+        slug: z6.string().max(SLUG_MAX).regex(SLUG_RE2, "a change folder's name: lower-case words joined by -, e.g. customer-reminders").describe("The change's folder name: specs/changes/<slug>/")
       },
       annotations: { readOnlyHint: true }
     },
@@ -1444,16 +1818,22 @@ async function hydrate(api, item, meta) {
 }
 async function buildContext(api, { taskDescription, filePaths = [], maxTokens }) {
   const budget = maxTokens ?? DEFAULT_BUDGET;
+  const failures = [];
+  const orEmpty = (empty) => (err) => {
+    failures.push(err);
+    return empty;
+  };
   const [rawGuardrails, rawSpecs, docs, stack, rules, docRepos] = await Promise.all([
-    api.get("/v1/guardrails").catch(() => []),
-    api.get("/v1/specs").catch(() => []),
-    api.get("/v1/docs").catch(() => ({ items: [] })),
-    api.get("/v1/ai/settings/stack").catch(() => []),
-    api.get("/v1/standards/rules").catch(() => []),
+    api.get("/v1/guardrails").catch(orEmpty([])),
+    api.get("/v1/specs").catch(orEmpty([])),
+    api.get("/v1/docs").catch(orEmpty({ items: [] })),
+    api.get("/v1/ai/settings/stack").catch(orEmpty([])),
+    api.get("/v1/standards/rules").catch(orEmpty([])),
     // Capability states — FAIL-OPEN: an unreadable config (older backend, a
     // blip) gates nothing, it can never hide working context.
     api.get("/v1/doc-repos").catch(() => null)
   ]);
+  if (failures.length === 5) throw failures[0];
   const disabled = (key2) => docRepos?.capabilities?.[key2]?.status === "disabled";
   const guardrails = disabled("fitness") ? [] : rawGuardrails;
   const specs = disabled("requirements") && disabled("design") && disabled("specs") ? [] : rawSpecs;
@@ -1660,47 +2040,280 @@ _Ranked lower \u2014 fetch with \`get_specs\` / \`get_docs\` if you need them._
     guardrails: selectedGuardrails.length
   };
   if (sections.length === 0) {
-    return { text: "No relevant context found for this task.", stats };
+    const text3 = failures.length ? `No context found for this task, but ${failures.length} of 5 reads failed, so this is not an all-clear: the team's rules may not have been read.` : "No relevant context found for this task.";
+    return { text: text3, stats };
   }
   const footer = `
 
 ---
-_Context: ${itemsWithBody} full text, ${itemsListed} listed, ${stats.itemsOmitted} omitted \xB7 ~${tokensUsed} of ${budget} tokens` + (bodyFailures > 0 ? ` \xB7 ${bodyFailures} body fetch(es) failed` : "") + `_`;
+_Context: ${itemsWithBody} full text, ${itemsListed} listed, ${stats.itemsOmitted} omitted \xB7 ~${tokensUsed} of ${budget} tokens` + (bodyFailures > 0 ? ` \xB7 ${bodyFailures} body fetch(es) failed` : "") + (failures.length > 0 ? ` \xB7 ${failures.length} of 5 reads failed` : "") + `_`;
   return { text: body + footer, stats };
 }
-
-// src/tools/get-context.ts
-function registerGetContext(server, apiClient) {
+
+// src/tools/get-context.ts
+function registerGetContext(server, apiClient) {
+  server.registerTool(
+    "get_context",
+    {
+      title: "Get Context",
+      description: "Intelligent context aggregator: fetches checks, specs, docs, and tech stack, ranks them by relevance to your current task, and returns the full text of the highest-ranked items within a token budget \u2014 each with the ID needed to fetch the rest. Use this instead of calling individual tools when you want curated, relevant context.",
+      inputSchema: {
+        task_description: z7.string().describe(
+          "What you're working on (e.g., 'add a new REST endpoint for user preferences')"
+        ),
+        file_paths: z7.array(z7.string()).optional().describe(
+          "File paths being edited \u2014 used for language/category detection"
+        ),
+        max_tokens: z7.number().optional().describe("Maximum token budget for the response (default: 4000)")
+      }
+    },
+    async ({ task_description, file_paths, max_tokens }) => {
+      const { text: text3 } = await buildContext(apiClient, {
+        taskDescription: task_description,
+        filePaths: file_paths,
+        maxTokens: max_tokens
+      });
+      return {
+        content: [{ type: "text", text: text3 }]
+      };
+    }
+  );
+}
+
+// src/tools/get-team-setup.ts
+var HELD_BECAUSE = {
+  "not-plain": `it is not a plain skill: it has frontmatter beyond a name and a description, files outside its own folders, or a command that runs as it loads. The team plugin carries it, and \`${SETUP_COMMAND}\` shows that before the person accepts`,
+  "outside-default-space": "it is outside the default space, so the team plugin does not carry it either. The person can read it in the console, then install it with `npx -y @systemdox/mcp-server install-skill <name>`",
+  "not-checked": "it could not be checked. Ask again later"
+};
+function describeSetup(setup) {
+  const lines = [`# Team setup of ${setup.workspace}`, ""];
+  const skills = setup.sessionBrief?.skills ?? [];
+  const held = setup.sessionBrief?.heldSkills ?? [];
+  lines.push(`## Skills a session installs by itself (${skills.length})`, "");
+  if (skills.length) {
+    for (const s of skills) lines.push(`- **${s.name}** version ${s.latestVersion}: ${s.description}`);
+  } else if (!setup.sessionBrief && setup.skills.length) {
+    lines.push(`- ${setup.skills.join(", ")}`);
+  } else {
+    lines.push("None.");
+  }
+  lines.push("");
+  if (held.length) {
+    lines.push(`## Skills that wait for the person (${held.length})`, "");
+    for (const h of held) lines.push(`- **${h.name}**: ${HELD_BECAUSE[h.reason] ?? h.reason}`);
+    lines.push("", "Do not install these yourself: each is the person's to decide.", "");
+  }
+  if (setup.plugin) {
+    lines.push(`## Team plugin`, "", `\`${setup.workspace}-setup\` version ${setup.plugin.version}.`);
+    for (const c of setup.plugin.hookCommands ?? []) lines.push(`- Hook: ${JSON.stringify(c)}`);
+    for (const m of setup.plugin.mcpServers ?? []) {
+      lines.push(`- MCP server ${JSON.stringify(m.name)}: ${JSON.stringify(m.url ?? [m.command, ...m.args ?? []].filter(Boolean).join(" "))}`);
+    }
+    lines.push("");
+  }
+  const parts = Object.entries(setup.parts ?? {});
+  if (parts.length) {
+    lines.push(`## Published parts`, "", ...parts.map(([p, v]) => `- ${p}: version ${v}`), "");
+  }
+  if (setup.memory?.length) {
+    lines.push(`## Team memory`, "", ...setup.memory.map((m) => `- ${m.project}: ${m.fileCount} file(s)`), "");
+  }
+  return lines;
+}
+function describeComputer(setup, state) {
+  const lines = ["## This computer", ""];
+  if (!setup.sessionBrief) {
+    return [...lines, "This SystemDox API is too old to compare this computer with the team setup."];
+  }
+  const skills = setup.sessionBrief.skills;
+  const latest = new Map(skills.map((s) => [s.name, s.latestVersion]));
+  lines.push(
+    state.missing.length ? `- Missing: ${state.missing.map((name) => `${name} version ${latest.get(name)}`).join(", ")}` : `- Missing: none of ${skills.length}`
+  );
+  if (state.behind.length) {
+    lines.push(`- Behind: ${state.behind.map((b) => `${b.name} (version ${b.here} here, latest ${b.latest})`).join(", ")}`);
+  }
+  if (state.notFromSystemDox.length) lines.push(`- Not from SystemDox, left alone: ${state.notFromSystemDox.join(", ")}`);
+  if (setup.plugin) {
+    lines.push(
+      state.pluginInstalled ? `- Team plugin: installed${state.pluginVersion ? `, ${state.pluginVersion}` : ""}; the latest is version ${setup.plugin.version}` : "- Team plugin: not installed"
+    );
+  }
+  lines.push("", "## What to do", "");
+  const steps = [];
+  if (state.missing.length) steps.push("Call install_skill for each missing skill, at the version named above. These are plain skills: installing writes files and runs nothing.");
+  if (state.behind.length) {
+    steps.push("Call install_skill for each skill behind, at the latest version named above. If it refuses because files were edited, tell the person and leave them.");
+  }
+  if (hasPersonParts(setup) && !state.pluginInstalled) {
+    steps.push(
+      `Hooks, MCP servers, team instructions and memory need the person: \`${SETUP_COMMAND}\` in their own terminal. Never answer its prompts for them.`
+    );
+  }
+  lines.push(...steps.length ? steps.map((s, i) => `${i + 1}. ${s}`) : ["Nothing."]);
+  return lines;
+}
+function registerGetTeamSetup(server, apiClient, { localFiles, keyProblem }) {
+  server.registerTool(
+    "get_team_setup",
+    {
+      title: "Get Team Setup",
+      description: localFiles ? "What this workspace's team setup holds (skills, plugin, hooks, MCP servers, memory) and what this computer lacks, with what to do about it. Call it to check whether this computer is set up. Reads only." : "What this workspace's team setup holds (skills, plugin, hooks, MCP servers, memory), and how to check this computer against it. Reads only.",
+      inputSchema: {},
+      annotations: { readOnlyHint: true }
+    },
+    async () => {
+      const read = await readTeamSetup(apiClient, { keyProblem, timeoutMs: 15e3 });
+      if ("problem" in read) return { content: [{ type: "text", text: read.problem }] };
+      const lines = describeSetup(read.setup);
+      if (localFiles) lines.push(...describeComputer(read.setup, await computerState(read.setup)));
+      else lines.push(CANNOT_SEE);
+      return { content: [{ type: "text", text: lines.join("\n") }] };
+    }
+  );
+}
+
+// src/tools/document-graph.ts
+import { z as z8 } from "zod";
+var DEFAULT_LIMIT2 = 50;
+var MAX_LIMIT = 200;
+var DEFAULT_HOPS = 6;
+var MAX_HOPS = 8;
+function place(file, line) {
+  return file ? `${file}:${line}` : "made by a person";
+}
+function known(provenance, confidence) {
+  return `${provenance} ${confidence}`;
+}
+function formatNeighbours(answer) {
+  const lines = [`# ${answer.doc.label}`, `\`${answer.doc.id}\``, ""];
+  if (answer.links.length === 0) lines.push("No links.");
+  for (const link of answer.links) {
+    lines.push(
+      `- ${link.direction} \xB7 ${link.relation} \xB7 ${known(link.provenance, link.confidence)} \xB7 ${link.other.label} \xB7 \`${link.other.id}\` \xB7 ${place(link.file, link.line)}`
+    );
+  }
+  if (answer.truncated) {
+    lines.push("", `Showing ${answer.links.length} of ${answer.total}. Raise limit to see more.`);
+  }
+  if (answer.ambiguous.length > 0) {
+    lines.push("", "## Ambiguous: not drawn, because each could mean several documents");
+    for (const entry of answer.ambiguous) {
+      const candidates = entry.candidates.map((c) => `${c.label} (${c.repo}, \`${c.id}\`)`);
+      lines.push(`- ${entry.reference} at ${place(entry.file, entry.line)}: ${candidates.join("; ")}`);
+    }
+  }
+  return lines.join("\n");
+}
+function formatPath(answer, maxHops) {
+  if (!answer.found) return `No path within ${maxHops} hops.`;
+  const lines = answer.steps.map((step, index) => {
+    const arrow = step.reversed ? "<-" : "->";
+    return `${index + 1}. ${step.from.label} ${arrow} ${step.relation} ${arrow} ${step.to.label} \xB7 ${known(step.provenance, step.confidence)} \xB7 ${place(step.file, step.line)}`;
+  });
+  return [...lines, "", `Path confidence: ${answer.confidence}`].join("\n");
+}
+function formatStats(stats, repoLinks) {
+  const { declared, extracted, inferred, ambiguous } = stats.links;
+  const lines = [
+    `# The graph: ${stats.nodeCount} documents, ${stats.edgeCount} links`,
+    "",
+    `Links: ${declared} declared \xB7 ${extracted} extracted \xB7 ${inferred} inferred \xB7 ${ambiguous} ambiguous (not drawn)`,
+    "",
+    "## Repositories"
+  ];
+  for (const repo of stats.repos) {
+    const state = repo.behind ? `BEHIND: pushed ${repo.headCommit || "unknown"} at ${repo.pushedAt}, index at ${repo.indexedCommit || "unknown"}` : `index at ${repo.indexedCommit || "unknown"}`;
+    lines.push(`- ${repo.repo}: ${repo.documents} documents, ${repo.links} links, ${state}`);
+  }
+  if (repoLinks.length > 0) {
+    lines.push("", "## Repository links");
+    for (const link of repoLinks) {
+      lines.push(
+        `- ${link.source} ${link.relation} ${link.target} \xB7 ${known(link.provenance, link.confidence)} \xB7 ${place(link.file, link.line)}`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+function refused(err) {
+  const status = err.status;
+  if (status !== 404 && status !== 400) throw err;
+  return {
+    content: [{ type: "text", text: err.message }],
+    isError: true
+  };
+}
+function registerDocumentGraph(server, apiClient) {
   server.registerTool(
-    "get_context",
+    "get_document_links",
     {
-      title: "Get Context",
-      description: "Intelligent context aggregator: fetches checks, specs, docs, and tech stack, ranks them by relevance to your current task, and returns the full text of the highest-ranked items within a token budget \u2014 each with the ID needed to fetch the rest. Use this instead of calling individual tools when you want curated, relevant context.",
+      description: "What one document links to and from, strongest first. Each link says how it is known: declared (a person made it), extracted (the file says so), or inferred (a reading that could be wrong), with a confidence and the file and line it came from. A reference that could mean several documents is listed as ambiguous with its candidates, and is never drawn as a link. doc_id is the id get_docs returns. Read-only.",
       inputSchema: {
-        task_description: z7.string().describe(
-          "What you're working on (e.g., 'add a new REST endpoint for user preferences')"
-        ),
-        file_paths: z7.array(z7.string()).optional().describe(
-          "File paths being edited \u2014 used for language/category detection"
-        ),
-        max_tokens: z7.number().optional().describe("Maximum token budget for the response (default: 4000)")
+        doc_id: z8.string().min(1).max(400).describe("A document id, as get_docs returns it"),
+        direction: z8.enum(["out", "in", "both"]).optional().describe("Default both"),
+        relation: z8.enum(["links_to", "cites", "mentions", "satisfies", "references"]).optional().describe("Only links of this kind"),
+        limit: z8.number().int().min(1).max(MAX_LIMIT).optional().describe(`Most links to show (default ${DEFAULT_LIMIT2})`)
+      },
+      annotations: { readOnlyHint: true }
+    },
+    async ({ doc_id, direction, relation, limit }) => {
+      const params = { doc: doc_id, limit: String(limit ?? DEFAULT_LIMIT2) };
+      if (direction) params.direction = direction;
+      if (relation) params.relation = relation;
+      try {
+        const answer = await apiClient.get("/v1/graph/neighbours", params);
+        return { content: [{ type: "text", text: formatNeighbours(answer) }] };
+      } catch (err) {
+        return refused(err);
       }
+    }
+  );
+  server.registerTool(
+    "trace_document_path",
+    {
+      description: "The shortest way two documents connect, walking links in either direction. Each step says how it is known, and the path is only as strong as its weakest step. Read-only.",
+      inputSchema: {
+        from: z8.string().min(1).max(400).describe("A document id, as get_docs returns it"),
+        to: z8.string().min(1).max(400).describe("A document id, as get_docs returns it"),
+        max_hops: z8.number().int().min(1).max(MAX_HOPS).optional().describe(`Longest path to look for (default ${DEFAULT_HOPS})`)
+      },
+      annotations: { readOnlyHint: true }
     },
-    async ({ task_description, file_paths, max_tokens }) => {
-      const { text: text3 } = await buildContext(apiClient, {
-        taskDescription: task_description,
-        filePaths: file_paths,
-        maxTokens: max_tokens
-      });
-      return {
-        content: [{ type: "text", text: text3 }]
-      };
+    async ({ from, to, max_hops }) => {
+      const hops = max_hops ?? DEFAULT_HOPS;
+      try {
+        const answer = await apiClient.get("/v1/graph/path", {
+          from,
+          to,
+          maxHops: String(hops)
+        });
+        return { content: [{ type: "text", text: formatPath(answer, hops) }] };
+      } catch (err) {
+        return refused(err);
+      }
+    }
+  );
+  server.registerTool(
+    "get_graph_stats",
+    {
+      description: "The state of the graph: links counted by how they are known, each repository's freshness (marked BEHIND when a push has not finished indexing), and how repositories depend on each other, from the files that declare it. Read-only.",
+      inputSchema: {},
+      annotations: { readOnlyHint: true }
+    },
+    async () => {
+      const [stats, repos] = await Promise.all([
+        apiClient.getFresh("/v1/graph/stats"),
+        apiClient.getFresh("/v1/graph/repos")
+      ]);
+      return { content: [{ type: "text", text: formatStats(stats, repos.links) }] };
     }
   );
 }
 
 // src/tools/create-guardrail.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var DESCRIPTION2 = "Create a new check in SystemDox. Use this when you discover a pattern that should be enforced (banned pattern, required pattern, coding rule).";
 var CATEGORIES = [
   "imports",
@@ -1713,13 +2326,13 @@ var CATEGORIES = [
   "data-access"
 ];
 var inputSchema2 = () => ({
-  title: z8.string().describe("Short title for the check"),
-  description: z8.string().describe("Detailed description of what the check enforces and why"),
-  severity: z8.enum(["critical", "high", "medium", "low"]).describe("Severity level"),
-  category: z8.enum(CATEGORIES).optional().describe("Category (defaults to conventions)"),
-  pattern: z8.string().optional().describe("Bad code pattern that should be avoided"),
-  fix: z8.string().optional().describe("Correct code pattern to use instead"),
-  fitness_test: z8.string().optional().describe("Shell command to detect violations in CI")
+  title: z9.string().describe("Short title for the check"),
+  description: z9.string().describe("Detailed description of what the check enforces and why"),
+  severity: z9.enum(["critical", "high", "medium", "low"]).describe("Severity level"),
+  category: z9.enum(CATEGORIES).optional().describe("Category (defaults to conventions)"),
+  pattern: z9.string().optional().describe("Bad code pattern that should be avoided"),
+  fix: z9.string().optional().describe("Correct code pattern to use instead"),
+  fitness_test: z9.string().optional().describe("Shell command to detect violations in CI")
 });
 function registerCreateGuardrail(server, apiClient) {
   const handler2 = async ({
@@ -1785,7 +2398,7 @@ function registerCreateGuardrail(server, apiClient) {
 }
 
 // src/tools/update-spec.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function registerUpdateSpec(server, apiClient) {
   server.registerTool(
     "update_spec",
@@ -1793,12 +2406,12 @@ function registerUpdateSpec(server, apiClient) {
       title: "Update Spec",
       description: "Update an existing SystemDox spec's proposal, tasks, or requirements. Only draft specs can be modified \u2014 published specs must be versioned first.",
       inputSchema: {
-        draft_id: z9.string().describe("ID of the spec to update"),
-        section: z9.enum(["proposal", "tasks", "requirements"]).describe("Which section to update"),
-        content: z9.string().describe(
+        draft_id: z10.string().describe("ID of the spec to update"),
+        section: z10.enum(["proposal", "tasks", "requirements"]).describe("Which section to update"),
+        content: z10.string().describe(
           "New markdown content for the section. For requirements, provide the full requirement content."
         ),
-        requirement_name: z9.string().optional().describe(
+        requirement_name: z10.string().optional().describe(
           "Name of the requirement (required when section is 'requirements')"
         )
       },
@@ -1824,235 +2437,22 @@ function registerUpdateSpec(server, apiClient) {
         body.proposalContent = content;
       } else if (section === "tasks") {
         body.taskContent = content;
-      } else if (section === "requirements") {
-        const existing = spec.requirements;
-        const newReq = {
-          name: requirement_name ?? "Untitled Requirement",
-          content
-        };
-        body.requirements = [...existing, newReq];
-      }
-      await apiClient.put(`/v1/specs/${draft_id}`, body);
-      apiClient.invalidateCache(`/v1/specs/${draft_id}`);
-      apiClient.invalidateCache("/v1/specs");
-      return {
-        content: [
-          {
-            type: "text",
-            text: `Updated spec "${spec.name}" \u2014 ${section} section modified.`
-          }
-        ]
-      };
-    }
-  );
-}
-
-// src/tools/report-decision.ts
-import { z as z10 } from "zod";
-function registerReportDecision(server, apiClient) {
-  server.registerTool(
-    "report_decision",
-    {
-      title: "Report Decision",
-      description: "Record an architecture decision made during development. Creates a draft ADR in SystemDox for human review.",
-      inputSchema: {
-        title: z10.string().describe("Decision title (e.g., 'Use WebSocket for real-time updates')"),
-        context: z10.string().describe("What prompted this decision \u2014 the problem or constraint"),
-        decision: z10.string().describe("What was decided and why"),
-        consequences: z10.string().describe("What this decision means going forward \u2014 trade-offs, follow-up work"),
-        related_files: z10.array(z10.string()).optional().describe("File paths related to this decision")
-      },
-      annotations: {
-        readOnlyHint: false
-      }
-    },
-    async ({ title, context, decision, consequences, related_files }) => {
-      const adrTitle = `ADR: ${title}`;
-      const created = await apiClient.post("/v1/specs", {
-        name: adrTitle
-      });
-      const relatedSection = related_files && related_files.length > 0 ? `
-
-## Related Files
-
-${related_files.map((f) => `- \`${f}\``).join("\n")}` : "";
-      const adrContent = `# ${adrTitle}
-
-**Date:** ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}
-**Status:** Draft (pending review)
-
-## Context
-
-${context}
-
-## Decision
-
-${decision}
-
-## Consequences
-
-${consequences}` + relatedSection;
-      await apiClient.put(`/v1/specs/${created.draftId}`, {
-        proposalContent: adrContent
-      });
-      apiClient.invalidateCache("/v1/specs");
-      return {
-        content: [
-          {
-            type: "text",
-            text: `Architecture decision recorded: **${adrTitle}** (spec id: ${created.draftId})
-
-Status: draft \u2014 review in SystemDox before publishing.`
-          }
-        ]
-      };
-    }
-  );
-}
-
-// src/tools/get-project-rules.ts
-import { z as z11 } from "zod";
-var CATEGORY_LABELS = {
-  deployment: "Deployment",
-  architecture: "Architecture",
-  security: "Security",
-  testing: "Testing",
-  process: "Process",
-  other: "Other"
-};
-function registerGetProjectRules(server, apiClient) {
-  server.registerTool(
-    "get_project_rules",
-    {
-      title: "Get Project Rules",
-      description: "Retrieve project rules defined in SystemDox Standards. These are team-defined principles covering deployment, architecture, security, testing, and process. Filter by category to get only relevant rules.",
-      inputSchema: {
-        category: z11.enum(["deployment", "architecture", "security", "testing", "process", "other"]).optional().describe("Filter by rule category")
-      }
-    },
-    async ({ category }) => {
-      const rules = await apiClient.get(
-        "/v1/standards/rules"
-      );
-      let filtered = rules;
-      if (category) {
-        filtered = filtered.filter(
-          (r) => r.category.toLowerCase() === category.toLowerCase()
-        );
-      }
-      if (filtered.length === 0) {
-        const text4 = rules.length === 0 ? `No project rules found. Add rules at ${configLink("/docs/rules", await workspaceBase(apiClient))}` : `No project rules found${category ? ` in category "${category}"` : ""}.`;
-        return {
-          content: [{ type: "text", text: text4 }]
-        };
-      }
-      const grouped = /* @__PURE__ */ new Map();
-      for (const rule of filtered) {
-        const cat = rule.category || "other";
-        if (!grouped.has(cat)) grouped.set(cat, []);
-        grouped.get(cat).push(rule);
-      }
-      let text3 = `Found ${filtered.length} project rule(s):
-
-`;
-      for (const [cat, catRules] of grouped) {
-        const label = CATEGORY_LABELS[cat] ?? cat;
-        text3 += `## ${label}
-
-`;
-        for (const rule of catRules) {
-          text3 += `- ${rule.text}
-`;
-        }
-        text3 += "\n";
-      }
-      return {
-        content: [
-          {
-            type: "text",
-            text: text3
-          }
-        ]
-      };
-    }
-  );
-}
-
-// src/tools/create-project-rule.ts
-import { z as z12 } from "zod";
-function registerCreateProjectRule(server, apiClient) {
-  server.registerTool(
-    "create_project_rule",
-    {
-      title: "Create Project Rule",
-      description: "Create a new project rule in SystemDox Standards. Use this when you discover a team principle or convention that should be enforced across the project.",
-      inputSchema: {
-        text: z12.string().describe(
-          "The rule statement \u2014 one enforceable principle per rule (e.g. 'All deployments MUST go through GitHub Actions workflows')"
-        ),
-        category: z12.enum(["deployment", "architecture", "security", "testing", "process", "other"]).describe("Rule category")
-      },
-      annotations: {
-        readOnlyHint: false
-      }
-    },
-    async ({ text: text3, category }) => {
-      const saved = await apiClient.post(
-        "/v1/standards/rules",
-        { text: text3, category }
-      );
-      apiClient.invalidateCache("/v1/standards/rules");
-      return {
-        content: [
-          {
-            type: "text",
-            text: `Project rule created: **${saved.text}** (id: ${saved.id}, category: ${saved.category})`
-          }
-        ]
-      };
-    }
-  );
-}
-
-// src/tools/get-prompt-templates.ts
-function registerGetPromptTemplates(server, apiClient) {
-  server.registerTool(
-    "get_prompt_templates",
-    {
-      title: "Get Prompt Templates",
-      description: "Retrieve reusable prompt templates from SystemDox Standards. These are preconfigured prompts that Gen AI should use when generating content \u2014 e.g. code review checklists, documentation templates, or analysis frameworks.",
-      inputSchema: {}
-    },
-    async () => {
-      const templates = await apiClient.get(
-        "/v1/standards/prompt-templates"
-      );
-      if (templates.length === 0) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: `No prompt templates found. Add templates at ${configLink("/docs/prompts", await workspaceBase(apiClient))}`
-            }
-          ]
+      } else if (section === "requirements") {
+        const existing = spec.requirements;
+        const newReq = {
+          name: requirement_name ?? "Untitled Requirement",
+          content
         };
+        body.requirements = [...existing, newReq];
       }
-      const text3 = templates.map(
-        (t) => `## ${t.name}
-
-` + (t.description ? `*${t.description}*
-
-` : "") + `\`\`\`
-${t.prompt}
-\`\`\``
-      ).join("\n\n---\n\n");
+      await apiClient.put(`/v1/specs/${draft_id}`, body);
+      apiClient.invalidateCache(`/v1/specs/${draft_id}`);
+      apiClient.invalidateCache("/v1/specs");
       return {
         content: [
           {
             type: "text",
-            text: `Found ${templates.length} prompt template(s):
-
-${text3}`
+            text: `Updated spec "${spec.name}" \u2014 ${section} section modified.`
           }
         ]
       };
@@ -2060,38 +2460,62 @@ ${text3}`
   );
 }
 
-// src/tools/create-prompt-template.ts
-import { z as z13 } from "zod";
-function registerCreatePromptTemplate(server, apiClient) {
+// src/tools/report-decision.ts
+import { z as z11 } from "zod";
+function registerReportDecision(server, apiClient) {
   server.registerTool(
-    "create_prompt_template",
+    "report_decision",
     {
-      title: "Create Prompt Template",
-      description: "Create a new reusable prompt template in SystemDox Standards. Use this to store preconfigured prompts for common AI tasks like code reviews, documentation generation, or analysis frameworks.",
+      title: "Report Decision",
+      description: "Record an architecture decision made during development. Creates a draft ADR in SystemDox for human review.",
       inputSchema: {
-        name: z13.string().describe("Short name for the template"),
-        description: z13.string().optional().describe("Brief description of when to use this template"),
-        prompt: z13.string().describe("The full prompt text that Gen AI will use when generating content")
+        title: z11.string().describe("Decision title (e.g., 'Use WebSocket for real-time updates')"),
+        context: z11.string().describe("What prompted this decision \u2014 the problem or constraint"),
+        decision: z11.string().describe("What was decided and why"),
+        consequences: z11.string().describe("What this decision means going forward \u2014 trade-offs, follow-up work"),
+        related_files: z11.array(z11.string()).optional().describe("File paths related to this decision")
       },
       annotations: {
         readOnlyHint: false
       }
     },
-    async ({ name, description, prompt }) => {
-      const saved = await apiClient.post(
-        "/v1/standards/prompt-templates",
-        {
-          name,
-          description: description ?? "",
-          prompt
-        }
-      );
-      apiClient.invalidateCache("/v1/standards/prompt-templates");
+    async ({ title, context, decision, consequences, related_files }) => {
+      const adrTitle = `ADR: ${title}`;
+      const created = await apiClient.post("/v1/specs", {
+        name: adrTitle
+      });
+      const relatedSection = related_files && related_files.length > 0 ? `
+
+## Related Files
+
+${related_files.map((f) => `- \`${f}\``).join("\n")}` : "";
+      const adrContent = `# ${adrTitle}
+
+**Date:** ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}
+**Status:** Draft (pending review)
+
+## Context
+
+${context}
+
+## Decision
+
+${decision}
+
+## Consequences
+
+${consequences}` + relatedSection;
+      await apiClient.put(`/v1/specs/${created.draftId}`, {
+        proposalContent: adrContent
+      });
+      apiClient.invalidateCache("/v1/specs");
       return {
         content: [
           {
             type: "text",
-            text: `Prompt template created: **${saved.name}** (id: ${saved.id})`
+            text: `Architecture decision recorded: **${adrTitle}** (spec id: ${created.draftId})
+
+Status: draft \u2014 review in SystemDox before publishing.`
           }
         ]
       };
@@ -2099,217 +2523,210 @@ function registerCreatePromptTemplate(server, apiClient) {
   );
 }
 
-// src/tools/skills.ts
-import { z as z14 } from "zod";
-import { homedir as homedir2 } from "os";
-import { basename, resolve as resolve2 } from "path";
-
-// src/lib/skills.ts
-import { createHash } from "crypto";
-import { lstat, mkdir, readdir, readFile, rm, writeFile } from "fs/promises";
-import { existsSync } from "fs";
-import { homedir } from "os";
-import { dirname, join, relative, resolve, sep } from "path";
-var MANIFEST_FILE = ".systemdox-skill.json";
-var ENTRY_FILE = "SKILL.md";
-var MAX_FILES = 100;
-var MAX_FILE_BYTES = 256 * 1024;
-var MAX_TOTAL_BYTES = 1024 * 1024;
-var NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-var SEGMENT_RE = /^[A-Za-z0-9._-]+$/;
-var SKIPPED = /* @__PURE__ */ new Set([MANIFEST_FILE, ".git", "node_modules", "__pycache__", ".DS_Store"]);
-var SkillInstallRefused = class extends Error {
-  constructor(dest, edited) {
-    super(
-      `${dest} has local changes in ${edited.length} file(s): ${edited.join(", ")}. Nothing was written. Move your changes aside, or install again with overwrite.`
-    );
-    this.dest = dest;
-    this.edited = edited;
-  }
-  dest;
-  edited;
+// src/tools/get-project-rules.ts
+import { z as z12 } from "zod";
+var CATEGORY_LABELS = {
+  deployment: "Deployment",
+  architecture: "Architecture",
+  security: "Security",
+  testing: "Testing",
+  process: "Process",
+  other: "Other"
 };
-function sha256(content) {
-  return createHash("sha256").update(content, "utf8").digest("hex");
-}
-function isValidName(name) {
-  return name.length <= 64 && NAME_RE.test(name);
-}
-function isValidPath(path) {
-  return path.length > 0 && path.length <= 512 && !path.startsWith("/") && path.split("/").every((s) => SEGMENT_RE.test(s) && s !== "." && s !== "..");
-}
-function frontmatterName(skillMd) {
-  const block = /^---\r?\n([\s\S]*?)\r?\n---/.exec(skillMd);
-  if (!block) return void 0;
-  const line = /^name:[ \t]*(.+?)[ \t]*$/m.exec(block[1]);
-  return line ? line[1].replace(/^(['"])(.*)\1$/, "$2") : void 0;
-}
-function defaultSkillDir(name) {
-  return join(homedir(), ".claude", "skills", name);
-}
-async function walk(root, { skipHidden }, dir = root, out = { files: [], links: [], hidden: [] }) {
-  for (const entry of await readdir(dir, { withFileTypes: true })) {
-    if (SKIPPED.has(entry.name) || entry.name.endsWith(".pyc")) continue;
-    const full = join(dir, entry.name);
-    const rel = relative(root, full).split(sep).join("/");
-    if (entry.isSymbolicLink()) out.links.push(rel);
-    else if (skipHidden && entry.name.startsWith(".")) out.hidden.push(rel);
-    else if (entry.isDirectory()) await walk(root, { skipHidden }, full, out);
-    else if (entry.isFile()) out.files.push(rel);
-  }
-  out.files.sort();
-  return out;
-}
-async function readTextFiles(root, paths, what) {
-  if (paths.length > MAX_FILES) {
-    throw new Error(`${root} holds ${paths.length} files: ${what} holds at most ${MAX_FILES}`);
-  }
-  const decoder = new TextDecoder("utf-8", { fatal: true });
-  const files = [];
-  let total = 0;
-  for (const path of paths) {
-    if (!isValidPath(path)) {
-      throw new Error(`${path}: file names may use letters, digits, ".", "_" and "-" only`);
-    }
-    const raw = await readFile(join(root, ...path.split("/")));
-    if (raw.includes(0)) throw new Error(`${path} is binary: ${what} holds text files only`);
-    if (raw.length > MAX_FILE_BYTES) {
-      throw new Error(`${path} is ${raw.length} bytes: a file holds at most ${MAX_FILE_BYTES}`);
-    }
-    total += raw.length;
-    if (total > MAX_TOTAL_BYTES) {
-      throw new Error(`the files pass ${MAX_TOTAL_BYTES} bytes at ${path}`);
-    }
-    let content;
-    try {
-      content = decoder.decode(raw);
-    } catch {
-      throw new Error(`${path} is not UTF-8 text`);
-    }
-    files.push({ path, content });
-  }
-  return files;
-}
-async function readSkillDirectory(directory) {
-  const root = resolve(directory);
-  if (!existsSync(join(root, ENTRY_FILE))) {
-    throw new Error(`${root} has no ${ENTRY_FILE}: a skill folder holds SKILL.md at its root`);
-  }
-  const walked = await walk(root, { skipHidden: true });
-  if (walked.links.length) {
-    throw new Error(`${walked.links.join(", ")}: links are not followed; copy the file into the skill folder`);
-  }
-  const files = await readTextFiles(root, walked.files, "a skill");
-  const skillMd = files.find((f) => f.path === ENTRY_FILE);
-  const name = frontmatterName(skillMd.content);
-  if (!name) throw new Error(`${ENTRY_FILE} has no frontmatter name`);
-  return { name, files, skipped: walked.hidden };
-}
-function within(dest, path) {
-  if (!isValidPath(path)) throw new Error(`refusing to write ${JSON.stringify(path)}: not a skill path`);
-  const full = resolve(dest, ...path.split("/"));
-  if (!full.startsWith(resolve(dest) + sep)) throw new Error(`refusing to write outside ${dest}: ${path}`);
-  return full;
-}
-async function readManifest(dest) {
-  try {
-    return JSON.parse(await readFile(join(dest, MANIFEST_FILE), "utf8"));
-  } catch {
-    return void 0;
-  }
-}
-async function installSkill(version, dest, { overwrite = false } = {}) {
-  if (!isValidName(version.name)) throw new Error(`refusing to install ${JSON.stringify(version.name)}: not a skill name`);
-  const incoming = new Map(version.files.map((f) => [f.path, f]));
-  for (const f of version.files) within(dest, f.path);
-  if (existsSync(dest) && (await lstat(dest)).isSymbolicLink()) {
-    throw new Error(`${dest} is a link: install into a real folder`);
-  }
-  const walked = existsSync(dest) ? await walk(dest, { skipHidden: false }) : { files: [], links: [], hidden: [] };
-  if (walked.links.length) {
-    throw new Error(`${dest} holds links (${walked.links.join(", ")}): remove them, nothing was written`);
-  }
-  const present = walked.files;
-  const manifest = await readManifest(dest);
-  const known = Object.fromEntries(
-    Object.entries(manifest?.files ?? {}).filter(([p, h]) => isValidPath(p) && typeof h === "string")
-  );
-  const edited = [];
-  const untracked = [];
-  for (const path of present) {
-    const content = await readFile(join(dest, ...path.split("/")), "utf8");
-    if (Object.hasOwn(known, path)) {
-      if (sha256(content) !== known[path]) edited.push(path);
-    } else if (!incoming.has(path) || sha256(content) !== incoming.get(path).sha256) {
-      if (incoming.has(path) || !manifest) edited.push(path);
-      else untracked.push(path);
+function registerGetProjectRules(server, apiClient) {
+  server.registerTool(
+    "get_project_rules",
+    {
+      title: "Get Project Rules",
+      description: "Retrieve project rules defined in SystemDox Standards. These are team-defined principles covering deployment, architecture, security, testing, and process. Filter by category to get only relevant rules.",
+      inputSchema: {
+        category: z12.enum(["deployment", "architecture", "security", "testing", "process", "other"]).optional().describe("Filter by rule category")
+      }
+    },
+    async ({ category }) => {
+      const rules = await apiClient.get(
+        "/v1/standards/rules"
+      );
+      let filtered = rules;
+      if (category) {
+        filtered = filtered.filter(
+          (r) => r.category.toLowerCase() === category.toLowerCase()
+        );
+      }
+      if (filtered.length === 0) {
+        const text4 = rules.length === 0 ? `No project rules found. Add rules at ${configLink("/docs/rules", await workspaceBase(apiClient))}` : `No project rules found${category ? ` in category "${category}"` : ""}.`;
+        return {
+          content: [{ type: "text", text: text4 }]
+        };
+      }
+      const grouped = /* @__PURE__ */ new Map();
+      for (const rule of filtered) {
+        const cat = rule.category || "other";
+        if (!grouped.has(cat)) grouped.set(cat, []);
+        grouped.get(cat).push(rule);
+      }
+      let text3 = `Found ${filtered.length} project rule(s):
+
+`;
+      for (const [cat, catRules] of grouped) {
+        const label = CATEGORY_LABELS[cat] ?? cat;
+        text3 += `## ${label}
+
+`;
+        for (const rule of catRules) {
+          text3 += `- ${rule.text}
+`;
+        }
+        text3 += "\n";
+      }
+      return {
+        content: [
+          {
+            type: "text",
+            text: text3
+          }
+        ]
+      };
     }
-  }
-  const blocking = edited.filter((p) => incoming.has(p) || !manifest);
-  if (blocking.length && !overwrite) throw new SkillInstallRefused(dest, blocking);
-  const written = [];
-  for (const f of version.files) {
-    const full = within(dest, f.path);
-    await mkdir(dirname(full), { recursive: true });
-    await writeFile(full, f.content, "utf8");
-    written.push(f.path);
-  }
-  const removed = [];
-  const keptEdited = [];
-  for (const path of Object.keys(known)) {
-    if (incoming.has(path) || !present.includes(path)) continue;
-    if (edited.includes(path)) {
-      keptEdited.push(path);
-      continue;
+  );
+}
+
+// src/tools/create-project-rule.ts
+import { z as z13 } from "zod";
+function registerCreateProjectRule(server, apiClient) {
+  server.registerTool(
+    "create_project_rule",
+    {
+      title: "Create Project Rule",
+      description: "Create a new project rule in SystemDox Standards. Use this when you discover a team principle or convention that should be enforced across the project.",
+      inputSchema: {
+        text: z13.string().describe(
+          "The rule statement \u2014 one enforceable principle per rule (e.g. 'All deployments MUST go through GitHub Actions workflows')"
+        ),
+        category: z13.enum(["deployment", "architecture", "security", "testing", "process", "other"]).describe("Rule category")
+      },
+      annotations: {
+        readOnlyHint: false
+      }
+    },
+    async ({ text: text3, category }) => {
+      const saved = await apiClient.post(
+        "/v1/standards/rules",
+        { text: text3, category }
+      );
+      apiClient.invalidateCache("/v1/standards/rules");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Project rule created: **${saved.text}** (id: ${saved.id}, category: ${saved.category})`
+          }
+        ]
+      };
     }
-    await rm(within(dest, path));
-    removed.push(path);
-  }
-  const next = {
-    name: version.name,
-    version: version.version,
-    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    files: Object.fromEntries(version.files.map((f) => [f.path, f.sha256]))
-  };
-  await writeFile(join(dest, MANIFEST_FILE), JSON.stringify(next, null, 2) + "\n", "utf8");
-  return {
-    dest,
-    version: version.version,
-    written,
-    removed,
-    keptUntracked: untracked.filter((p) => !incoming.has(p)),
-    keptEdited
-  };
+  );
 }
-function fenceFor(text3) {
-  const longest = Math.max(0, ...(text3.match(/`+/g) ?? []).map((r) => r.length));
-  return "`".repeat(Math.max(3, longest + 1));
+
+// src/tools/get-prompt-templates.ts
+function registerGetPromptTemplates(server, apiClient) {
+  server.registerTool(
+    "get_prompt_templates",
+    {
+      title: "Get Prompt Templates",
+      description: "Retrieve reusable prompt templates from SystemDox Standards. These are preconfigured prompts that Gen AI should use when generating content \u2014 e.g. code review checklists, documentation templates, or analysis frameworks.",
+      inputSchema: {}
+    },
+    async () => {
+      const templates = await apiClient.get(
+        "/v1/standards/prompt-templates"
+      );
+      if (templates.length === 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `No prompt templates found. Add templates at ${configLink("/docs/prompts", await workspaceBase(apiClient))}`
+            }
+          ]
+        };
+      }
+      const text3 = templates.map(
+        (t) => `## ${t.name}
+
+` + (t.description ? `*${t.description}*
+
+` : "") + `\`\`\`
+${t.prompt}
+\`\`\``
+      ).join("\n\n---\n\n");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Found ${templates.length} prompt template(s):
+
+${text3}`
+          }
+        ]
+      };
+    }
+  );
 }
-function describeInstall(name, r) {
-  const lines = [
-    `Installed ${name} version ${r.version} into ${r.dest} (${r.written.length} file(s)).`
-  ];
-  if (r.removed.length) lines.push(`Removed (no longer in the skill): ${r.removed.join(", ")}`);
-  if (r.keptEdited.length) {
-    lines.push(`Kept, edited here and no longer in the skill: ${r.keptEdited.join(", ")}`);
-  }
-  if (r.keptUntracked.length) lines.push(`Kept, added here: ${r.keptUntracked.join(", ")}`);
-  lines.push("Start a new Claude Code session to load it.");
-  return lines.join("\n");
+
+// src/tools/create-prompt-template.ts
+import { z as z14 } from "zod";
+function registerCreatePromptTemplate(server, apiClient) {
+  server.registerTool(
+    "create_prompt_template",
+    {
+      title: "Create Prompt Template",
+      description: "Create a new reusable prompt template in SystemDox Standards. Use this to store preconfigured prompts for common AI tasks like code reviews, documentation generation, or analysis frameworks.",
+      inputSchema: {
+        name: z14.string().describe("Short name for the template"),
+        description: z14.string().optional().describe("Brief description of when to use this template"),
+        prompt: z14.string().describe("The full prompt text that Gen AI will use when generating content")
+      },
+      annotations: {
+        readOnlyHint: false
+      }
+    },
+    async ({ name, description, prompt }) => {
+      const saved = await apiClient.post(
+        "/v1/standards/prompt-templates",
+        {
+          name,
+          description: description ?? "",
+          prompt
+        }
+      );
+      apiClient.invalidateCache("/v1/standards/prompt-templates");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Prompt template created: **${saved.name}** (id: ${saved.id})`
+          }
+        ]
+      };
+    }
+  );
 }
 
 // src/tools/skills.ts
+import { z as z15 } from "zod";
+import { homedir as homedir3 } from "os";
+import { basename, resolve as resolve2 } from "path";
 var SKILLS = "/v1/standards/skills";
 function expandHome(path) {
-  return path.replace(/^~(?=$|[\\/])/, homedir2());
+  return path.replace(/^~(?=$|[\\/])/, homedir3());
 }
 function text(t) {
   return { content: [{ type: "text", text: t }] };
 }
 function registerSkillTools(server, apiClient, { localFiles }) {
-  const fileSchema = z14.object({
-    path: z14.string().describe('Path inside the skill folder, forward slashes, e.g. "references/guide.md"'),
-    content: z14.string().describe("The file's full text, exactly as it is")
+  const fileSchema = z15.object({
+    path: z15.string().describe('Path inside the skill folder, forward slashes, e.g. "references/guide.md"'),
+    content: z15.string().describe("The file's full text, exactly as it is")
   });
   server.registerTool(
     "publish_skill",
@@ -2318,13 +2735,13 @@ function registerSkillTools(server, apiClient, { localFiles }) {
       description: localFiles ? "Publish a Claude Code skill folder (SKILL.md plus its references and scripts) to SystemDox so it can be installed on any computer. Pass `directory` (e.g. ~/.claude/skills/<name>): the server reads the files itself, byte for byte. Publishing a name again makes a new version. Never retype the files into `files` when the folder is on this computer." : "Publish a Claude Code skill (SKILL.md plus its references and scripts) to SystemDox so it can be installed on any computer. Pass every file of the folder in `files`, exactly as it is. Publishing a name again makes a new version.",
       inputSchema: {
         ...localFiles ? {
-          directory: z14.string().optional().describe("The skill folder on this computer, holding SKILL.md at its root")
+          directory: z15.string().optional().describe("The skill folder on this computer, holding SKILL.md at its root")
         } : {},
-        files: z14.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the skill folder"),
-        name: z14.string().optional().describe("The skill's name; defaults to SKILL.md's frontmatter name and must match it"),
-        spaceId: z14.string().optional().describe("Space for a NEW skill (default: your default space)"),
-        note: z14.string().max(500).optional().describe(`A short change note for this version, shown in the console's history (e.g. "Fix the GA4 step")`),
-        baseVersion: z14.number().int().positive().optional().describe(
+        files: z15.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the skill folder"),
+        name: z15.string().optional().describe("The skill's name; defaults to SKILL.md's frontmatter name and must match it"),
+        spaceId: z15.string().optional().describe("Space for a NEW skill (default: your default space)"),
+        note: z15.string().max(500).optional().describe(`A short change note for this version, shown in the console's history (e.g. "Fix the GA4 step")`),
+        baseVersion: z15.number().int().positive().optional().describe(
           "The version these files were edited from. When given, the publish is refused (SYD-K017) if someone published a newer version since, instead of replacing their changes"
         )
       },
@@ -2390,10 +2807,10 @@ Left out (hidden files are never part of a skill): ${skipped.join(", ")}` : "")
       title: "Install Skill",
       description: localFiles ? "Install a skill published to SystemDox onto this computer (default ~/.claude/skills/<name>/). Refuses, naming the files, when a file there was edited since it was installed, unless overwrite is true. Never runs anything." : "Fetch a skill published to SystemDox so you can install it: returns every file and the folder to write them into (default ~/.claude/skills/<name>/). Write each file exactly, then the manifest it shows.",
       inputSchema: {
-        name: z14.string().describe("The skill's name"),
-        version: z14.number().int().positive().optional().describe("A version number (default: the latest)"),
-        target: z14.string().optional().describe("Folder to install into, e.g. a repo's .claude/skills/<name>"),
-        ...localFiles ? { overwrite: z14.boolean().optional().describe("Replace files edited since they were installed") } : {}
+        name: z15.string().describe("The skill's name"),
+        version: z15.number().int().positive().optional().describe("A version number (default: the latest)"),
+        target: z15.string().optional().describe("Folder to install into, e.g. a repo's .claude/skills/<name>"),
+        ...localFiles ? { overwrite: z15.boolean().optional().describe("Replace files edited since they were installed") } : {}
       },
       annotations: { readOnlyHint: !localFiles }
     },
@@ -2439,11 +2856,11 @@ ${body}`
 }
 
 // src/tools/team-setup.ts
-import { z as z15 } from "zod";
-import { existsSync as existsSync3 } from "fs";
+import { z as z16 } from "zod";
+import { existsSync as existsSync4 } from "fs";
 import { lstat as lstat2 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { join as join4, resolve as resolve4 } from "path";
+import { join as join5, resolve as resolve4 } from "path";
 
 // src/lib/person-values.ts
 var PHONE = "phone";
@@ -2524,9 +2941,9 @@ var PARTS2 = ["hooks", "mcp", "agents", "commands", "instructions"];
 var PERSON_ID_RE = new RegExp(`^${PERSON_ID}$`);
 
 // src/sync-memory.ts
-import { existsSync as existsSync2 } from "fs";
-import { mkdir as mkdir3, readdir as readdir2, readFile as readFile3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname3, join as join3, resolve as resolve3 } from "path";
+import { existsSync as existsSync3 } from "fs";
+import { mkdir as mkdir3, readdir as readdir2, readFile as readFile4, rm as rm3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, join as join4, resolve as resolve3 } from "path";
 
 // src/lib/memory-sync.ts
 import { createHash as createHash2 } from "crypto";
@@ -2797,63 +3214,6 @@ function lineDiff(before, after) {
   return out;
 }
 
-// src/lib/team-setup-files.ts
-import { execFile } from "child_process";
-import { chmod, mkdir as mkdir2, readFile as readFile2, rename, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import { homedir as homedir3, userInfo } from "os";
-import { dirname as dirname2, join as join2 } from "path";
-import { promisify } from "util";
-var SLUG_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-function isWorkspace(value) {
-  return typeof value === "string" && value.length <= 64 && SLUG_RE2.test(value);
-}
-function homeDir() {
-  return homedir3();
-}
-function systemdoxDir() {
-  return join2(homeDir(), ".claude", "systemdox");
-}
-function workspaceDir(workspace) {
-  if (!isWorkspace(workspace)) throw new Error(`${JSON.stringify(workspace)} is not a workspace name`);
-  return join2(systemdoxDir(), workspace);
-}
-function statePath(workspace) {
-  return join2(workspaceDir(workspace), "state.json");
-}
-async function readJson(path, empty) {
-  let text3;
-  try {
-    text3 = await readFile2(path, "utf8");
-  } catch (e) {
-    if (e.code === "ENOENT") return empty;
-    throw e;
-  }
-  try {
-    return JSON.parse(text3);
-  } catch {
-    throw new Error(`${path} is not valid JSON: fix or remove it, then run this again`);
-  }
-}
-async function writeJsonAtomically(path, value, mode) {
-  await mkdir2(dirname2(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.tmp`;
-  await writeFile2(tmp, JSON.stringify(value, null, 2) + "\n", mode === void 0 ? "utf8" : { encoding: "utf8", mode });
-  await rename(tmp, path);
-}
-var run = promisify(execFile);
-async function readState(workspace) {
-  return readJson(statePath(workspace), {});
-}
-async function writeState(workspace, state) {
-  await writeJsonAtomically(statePath(workspace), state);
-}
-async function updateState(workspace, change) {
-  const state = await readState(workspace);
-  change(state);
-  await writeState(workspace, state);
-  return state;
-}
-
 // src/sync-memory.ts
 var SYNC_MEMORY_COMMAND = "npx -y @systemdox/mcp-server sync-memory";
 var SyncFailed = class extends Error {
@@ -2863,7 +3223,7 @@ function refusal(e) {
   const { status, code } = e;
   return { status: typeof status === "number" ? status : void 0, code: typeof code === "string" ? code : void 0 };
 }
-var toPath = (root, rel) => join3(root, ...rel.split("/"));
+var toPath = (root, rel) => join4(root, ...rel.split("/"));
 async function readFolder(root) {
   const files = {};
   const names = /* @__PURE__ */ new Set();
@@ -2871,14 +3231,14 @@ async function readFolder(root) {
     for (const e of await readdir2(dir, { withFileTypes: true })) {
       if (e.name.startsWith(".")) continue;
       const rel = prefix ? `${prefix}/${e.name}` : e.name;
-      if (e.isDirectory()) await walk2(join3(dir, e.name), rel);
+      if (e.isDirectory()) await walk2(join4(dir, e.name), rel);
       else if (e.isFile()) {
         names.add(rel.toLowerCase());
-        if (e.name.endsWith(".md")) files[rel] = await readFile3(join3(dir, e.name), "utf8");
+        if (e.name.endsWith(".md")) files[rel] = await readFile4(join4(dir, e.name), "utf8");
       }
     }
   }
-  if (existsSync2(root)) await walk2(root, "");
+  if (existsSync3(root)) await walk2(root, "");
   return { files, names };
 }
 async function pullTeam(client, ws, project) {
@@ -3087,11 +3447,11 @@ async function people(opts, ws, files, report, hint) {
           report.people.push({ kind: g.kind, answer: ANSWER_WORDS[result.stored[0].answer], label: result.stored[0].label, personId: result.stored[0].personId });
           break;
         }
-        const refused = result.refused[0];
-        if (refused?.code === "SYD-K021") {
-          out(`  ${refused.detail}. Add them in Staff first, or answer p to file them.`);
+        const refused2 = result.refused[0];
+        if (refused2?.code === "SYD-K021") {
+          out(`  ${refused2.detail}. Add them in Staff first, or answer p to file them.`);
           choices = choices.filter((c) => c !== "m");
-        } else if (refused) out(`  ${refused.detail}`);
+        } else if (refused2) out(`  ${refused2.detail}`);
       }
     }
     for (let i = 0; i < filed.length; i += 50) {
@@ -3235,7 +3595,7 @@ async function syncMemory(opts) {
         own.memory.length ? `${ws} has ${own.memory.length} team memories (${own.memory.map((m) => m.project).join(", ")}): name one with --project.` : `${ws} has no team memory yet: name the project to start with --project.`
       );
     }
-    const dir = resolve3(opts.dir ?? join3(workspaceDir(ws), "memory", project));
+    const dir = resolve3(opts.dir ?? join4(workspaceDir(ws), "memory", project));
     const run2 = { ...opts, dir };
     const hint = [SYNC_MEMORY_COMMAND, `--project ${project}`, opts.dir ? `--dir "${opts.dir}"` : ""].filter(Boolean).join(" ");
     const report = new Report();
@@ -3385,21 +3745,21 @@ async function readPartDirectory(part, directory) {
     let present = true;
     for (let i = 1; i <= segments.length; i++) {
       const rel = segments.slice(0, i).join("/");
-      if (await isLink(join4(root, ...segments.slice(0, i)))) {
+      if (await isLink(join5(root, ...segments.slice(0, i)))) {
         links.push(rel);
         present = false;
         break;
       }
     }
-    if (present && existsSync3(join4(root, ...segments))) paths.push(path);
+    if (present && existsSync4(join5(root, ...segments))) paths.push(path);
   }
   for (const { dir, md } of layout.folders) {
-    const full = join4(root, dir);
+    const full = join5(root, dir);
     if (await isLink(full)) {
       links.push(dir);
       continue;
     }
-    if (!existsSync3(full)) continue;
+    if (!existsSync4(full)) continue;
     const walked = await walk(full, { skipHidden: true });
     links.push(...walked.links.map((p) => `${dir}/${p}`));
     leftOut.push(...walked.hidden.map((p) => `${dir}/${p}`));
@@ -3439,9 +3799,9 @@ function describePerson(id, person) {
   return lines.join("\n");
 }
 function registerTeamSetupTools(server, apiClient, { localFiles }) {
-  const fileSchema = z15.object({
-    path: z15.string().describe(`Path inside the part's folder, forward slashes, e.g. "hooks/hooks.json"`),
-    content: z15.string().describe("The file's full text, exactly as it is")
+  const fileSchema = z16.object({
+    path: z16.string().describe(`Path inside the part's folder, forward slashes, e.g. "hooks/hooks.json"`),
+    content: z16.string().describe("The file's full text, exactly as it is")
   });
   server.registerTool(
     "publish_setup_part",
@@ -3449,13 +3809,13 @@ function registerTeamSetupTools(server, apiClient, { localFiles }) {
       title: "Publish Setup Part",
       description: "Publish one part of your team's Claude Code setup to SystemDox: `hooks` (hooks/hooks.json and the scripts/ it calls), `mcp` (.mcp.json), `agents` (agents/*.md), `commands` (commands/*.md) or `instructions` (CLAUDE.md). Every part but instructions makes a new version of the team plugin, which each member accepts at their next update. Publishing hooks, mcp, agents or commands needs the admin role. " + (localFiles ? "Pass `directory`: the server reads only the files the part accepts, byte for byte, and refuses a link, a binary file or a file too large before anything is sent. Never retype the files into `files` when the folder is on this computer." : "Pass every file of the part in `files`, exactly as it is."),
       inputSchema: {
-        part: z15.enum(PARTS2).describe("Which part of the setup"),
+        part: z16.enum(PARTS2).describe("Which part of the setup"),
         ...localFiles ? {
-          directory: z15.string().optional().describe(
+          directory: z16.string().optional().describe(
             "The folder on this computer: for hooks, the one holding hooks/hooks.json and scripts/; for mcp, the one holding .mcp.json; for instructions, the one holding CLAUDE.md; for agents or commands, the one holding agents/ or commands/"
           )
         } : {},
-        files: z15.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the part")
+        files: z16.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the part")
       },
       annotations: { readOnlyHint: false }
     },
@@ -3491,7 +3851,7 @@ function registerTeamSetupTools(server, apiClient, { localFiles }) {
       title: "Resolve Person",
       description: "Read back a person that a team memory names by identifier, written as `con_\u2026` (label), `ctc_\u2026` or `usr_\u2026`: their label, name, phone number and email address, from the vault that holds them. The details are for this session only: never write them into a memory file; the memory keeps the identifier. Writes nothing.",
       inputSchema: {
-        id: z15.string().regex(PERSON_ID_RE, "a con_, ctc_ or usr_ identifier, as written in the memory").describe("The identifier, e.g. con_01JC2Q8Y4M7T0X3K5N9P2R6S8V")
+        id: z16.string().regex(PERSON_ID_RE, "a con_, ctc_ or usr_ identifier, as written in the memory").describe("The identifier, e.g. con_01JC2Q8Y4M7T0X3K5N9P2R6S8V")
       },
       annotations: { readOnlyHint: true }
     },
@@ -3508,8 +3868,8 @@ function registerTeamSetupTools(server, apiClient, { localFiles }) {
       title: "Sync Memory",
       description: `Sync one project's team memory on this computer with SystemDox: pull the files the team changed, push the ones changed here, keep both texts of a file changed on both sides. It never answers for a person: a file that still holds a phone number, an email address or a home-folder path is skipped and listed, with the command for the member to run in their own terminal (\`${SYNC_MEMORY_COMMAND}\`). Pass dryRun to see what it would do without writing or sending anything.`,
       inputSchema: {
-        project: z15.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "a project name: lower case letters, digits and -").optional().describe("The project's team memory, e.g. puglieseweb-ltd; needed when the workspace has more than one"),
-        dryRun: z15.boolean().optional().describe("Show what would be pulled, pushed, deleted, conflicted and skipped, and change nothing")
+        project: z16.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "a project name: lower case letters, digits and -").optional().describe("The project's team memory, e.g. puglieseweb-ltd; needed when the workspace has more than one"),
+        dryRun: z16.boolean().optional().describe("Show what would be pulled, pushed, deleted, conflicted and skipped, and change nothing")
       },
       annotations: { readOnlyHint: false }
     },
@@ -3527,12 +3887,15 @@ function registerTeamSetupTools(server, apiClient, { localFiles }) {
 }
 
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.49" : "0.0.0-dev";
-function createServer(apiClient, { localFiles = false } = {}) {
-  const server = new McpServer({
-    name: "systemdox-mcp-server",
-    version: SERVER_VERSION
-  });
+var SERVER_VERSION = true ? "0.1.50" : "0.0.0-dev";
+function createServer(apiClient, { localFiles = false, instructions, keyProblem } = {}) {
+  const server = new McpServer(
+    {
+      name: "systemdox-mcp-server",
+      version: SERVER_VERSION
+    },
+    instructions ? { instructions } : void 0
+  );
   registerGetGuardrails(server, apiClient);
   registerGetSpecs(server, apiClient);
   registerGetDocs(server, apiClient);
@@ -3543,6 +3906,8 @@ function createServer(apiClient, { localFiles = false } = {}) {
   registerGetContext(server, apiClient);
   registerGetProjectRules(server, apiClient);
   registerGetPromptTemplates(server, apiClient);
+  registerGetTeamSetup(server, apiClient, { localFiles, keyProblem });
+  registerDocumentGraph(server, apiClient);
   registerCreateGuardrail(server, apiClient);
   registerUpdateSpec(server, apiClient);
   registerReportDecision(server, apiClient);
@@ -3562,6 +3927,14 @@ function lowercaseHeaders(headers) {
   }
   return out;
 }
+function opensSession(rawBody) {
+  try {
+    const parsed = JSON.parse(rawBody);
+    return (Array.isArray(parsed) ? parsed : [parsed]).some((m) => m?.method === "initialize");
+  } catch {
+    return false;
+  }
+}
 function jsonError(statusCode, message) {
   return {
     statusCode,
@@ -3615,7 +3988,8 @@ async function handler(event) {
     // per-request client; never cache across invocations
     defaultOrg: void 0
   });
-  const server = createServer(apiClient);
+  const instructions = opensSession(rawBody) ? await sessionInstructions(apiClient) : void 0;
+  const server = createServer(apiClient, { instructions });
   const transport = new WebStandardStreamableHTTPServerTransport({
     sessionIdGenerator: void 0,
     // stateless — every POST is independent