@systemdox/mcp-server 0.1.49 → 0.1.51

package/dist/cli.js

@@ -301,14 +301,6 @@ var init_api_client = __esm({
         this.config = config2;
         this.cache = new ResponseCache(config2.cacheTtlMs);
       }
-      async validate() {
-        const res = await this.fetchRaw("/v1/health");
-        if (!res.ok) {
-          throw new Error(
-            `SystemDox API authentication failed (${res.status}). Check your SYSTEMDOX_API_KEY.`
-          );
-        }
-      }
       async get(path, params) {
         const url = this.buildUrl(path, params);
         const cacheKey = url.toString();
@@ -322,8 +314,8 @@ var init_api_client = __esm({
       }
       /** A read that skips the cache: an install must take the version that is
        * latest now, not the one cached before someone published another. */
-      async getFresh(path) {
-        const res = await this.fetchRaw(path);
+      async getFresh(path, signal) {
+        const res = await this.fetchRaw(path, void 0, signal);
         if (!res.ok) throw new SystemDoxApiError(res.status, await res.text());
         return await res.json();
       }
@@ -353,8 +345,8 @@ var init_api_client = __esm({
       // One method per operationId. Every read skips the cache: setup, sync and
       // plugin-path act on what the workspace holds now.
       /** getOwnTeamSetup: the key's own workspace, named in `workspace`. */
-      getOwnTeamSetup() {
-        return this.getFresh(TEAM_SETUP);
+      getOwnTeamSetup(signal) {
+        return this.getFresh(TEAM_SETUP, signal);
       }
       getTeamSetup(workspace) {
         return this.getFresh(`${TEAM_SETUP}/${seg(workspace)}`);
@@ -458,14 +450,15 @@ var init_api_client = __esm({
         }
         return url;
       }
-      async fetchRaw(path, params) {
+      async fetchRaw(path, params, signal) {
         const url = this.buildUrl(path, params);
         return fetch(url, {
           headers: {
             Authorization: `Bearer ${this.config.apiKey}`,
             "X-API-Key": this.config.apiKey,
             Accept: "application/json"
-          }
+          },
+          signal
         });
       }
     };
@@ -1030,11 +1023,11 @@ async function people(opts, ws, files, report, hint) {
           report.people.push({ kind: g.kind, answer: ANSWER_WORDS[result.stored[0].answer], label: result.stored[0].label, personId: result.stored[0].personId });
           break;
         }
-        const refused = result.refused[0];
-        if (refused?.code === "SYD-K021") {
-          out(`  ${refused.detail}. Add them in Staff first, or answer p to file them.`);
+        const refused2 = result.refused[0];
+        if (refused2?.code === "SYD-K021") {
+          out(`  ${refused2.detail}. Add them in Staff first, or answer p to file them.`);
           choices = choices.filter((c) => c !== "m");
-        } else if (refused) out(`  ${refused.detail}`);
+        } else if (refused2) out(`  ${refused2.detail}`);
       }
     }
     for (let i = 0; i < filed.length; i += 50) {
@@ -1773,9 +1766,9 @@ async function runTeamSetup(opts) {
       const id = `${ws}-setup@${marketplaceName}`;
       const installed = await readJsonQuietly(join3(pluginsDir, "installed_plugins.json"));
       if (!installed?.plugins?.[id]) {
-        const known = await readJsonQuietly(join3(pluginsDir, "known_marketplaces.json"));
+        const known2 = await readJsonQuietly(join3(pluginsDir, "known_marketplaces.json"));
         const install = `Run \`claude plugin install ${id}\` in your own terminal and accept the command it shows.`;
-        const steps = known && typeof known === "object" && known[marketplaceName] ? ["One step is left:", `1. ${install}`] : ["Two steps are left:", "1. Open Claude Code once in any folder, then close it.", `2. ${install}`];
+        const steps = known2 && typeof known2 === "object" && known2[marketplaceName] ? ["One step is left:", `1. ${install}`] : ["Two steps are left:", "1. Open Claude Code once in any folder, then close it.", `2. ${install}`];
         out("");
         steps.forEach((l) => out(l));
       }
@@ -1835,6 +1828,7 @@ __export(setup_mcp_exports, {
   writeServerEntry: () => writeServerEntry
 });
 import { existsSync as existsSync3, readFileSync } from "fs";
+import { mkdir as mkdir4 } from "fs/promises";
 import { join as join4 } from "path";
 async function validateApiKey(apiKey, apiUrl) {
   try {
@@ -1962,6 +1956,7 @@ async function setupMcpServer(opts) {
   }
   try {
     if ((await readCredentials())[workspace]?.apiKey !== apiKey) await writeCredentials(workspace, apiKey);
+    await mkdir4(join4(homeDir(), ".claude", "skills"), { recursive: true });
     const several = Object.keys(await readCredentials()).length > 1;
     for (const target of selected) {
       const removed = await writeServerEntry(target.path, apiUrl, several ? workspace : void 0);
@@ -1979,9 +1974,10 @@ async function setupMcpServer(opts) {
   Your key for ${workspace} is in ${credentialsPath()} (readable by you alone), not in these configs.
 
   Done! Restart your AI coding tool to activate the SystemDox MCP server.
-  The server provides 21 tools: get_context, get_checks,
+  The server provides 25 tools: get_context, get_team_setup, get_checks,
   get_project_rules, get_prompt_templates, get_specs, get_docs,
   get_tech_stack, get_planning_context, get_plan_board, get_change,
+  get_document_links, trace_document_path, get_graph_stats,
   create_check, create_project_rule, create_prompt_template,
   update_spec, report_decision, publish_skill, list_skills,
   install_skill, publish_setup_part, resolve_person, sync_memory.
@@ -2006,7 +2002,7 @@ var init_setup_mcp = __esm({
 
 // src/lib/skills.ts
 import { createHash as createHash3 } from "crypto";
-import { lstat, mkdir as mkdir4, readdir as readdir3, readFile as readFile4, rm as rm3, writeFile as writeFile4 } from "fs/promises";
+import { lstat, mkdir as mkdir5, readdir as readdir3, readFile as readFile4, rm as rm3, writeFile as writeFile4 } from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname4, join as join5, relative, resolve as resolve3, sep } from "path";
@@ -2017,7 +2013,7 @@ function isValidName(name) {
   return name.length <= 64 && NAME_RE.test(name);
 }
 function isValidPath(path) {
-  return path.length > 0 && path.length <= 512 && !path.startsWith("/") && path.split("/").every((s) => SEGMENT_RE.test(s) && s !== "." && s !== "..");
+  return path.length > 0 && path.length <= 512 && !path.startsWith("/") && path.split("/").every((s) => SEGMENT_RE.test(s) && s !== "." && s !== ".." && s !== PLUGIN_MANIFEST_FOLDER);
 }
 function frontmatterName(skillMd) {
   const block = /^---\r?\n([\s\S]*?)\r?\n---/.exec(skillMd);
@@ -2112,15 +2108,15 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
   }
   const present = walked.files;
   const manifest = await readManifest(dest);
-  const known = Object.fromEntries(
+  const known2 = Object.fromEntries(
     Object.entries(manifest?.files ?? {}).filter(([p, h]) => isValidPath(p) && typeof h === "string")
   );
   const edited = [];
   const untracked = [];
   for (const path of present) {
     const content = await readFile4(join5(dest, ...path.split("/")), "utf8");
-    if (Object.hasOwn(known, path)) {
-      if (sha2563(content) !== known[path]) edited.push(path);
+    if (Object.hasOwn(known2, path)) {
+      if (sha2563(content) !== known2[path]) edited.push(path);
     } else if (!incoming.has(path) || sha2563(content) !== incoming.get(path).sha256) {
       if (incoming.has(path) || !manifest) edited.push(path);
       else untracked.push(path);
@@ -2131,13 +2127,13 @@ async function installSkill(version, dest, { overwrite = false } = {}) {
   const written = [];
   for (const f of version.files) {
     const full = within(dest, f.path);
-    await mkdir4(dirname4(full), { recursive: true });
+    await mkdir5(dirname4(full), { recursive: true });
     await writeFile4(full, f.content, "utf8");
     written.push(f.path);
   }
   const removed = [];
   const keptEdited = [];
-  for (const path of Object.keys(known)) {
+  for (const path of Object.keys(known2)) {
     if (incoming.has(path) || !present.includes(path)) continue;
     if (edited.includes(path)) {
       keptEdited.push(path);
@@ -2166,6 +2162,9 @@ function fenceFor(text3) {
   const longest = Math.max(0, ...(text3.match(/`+/g) ?? []).map((r) => r.length));
   return "`".repeat(Math.max(3, longest + 1));
 }
+function afterInstall(skillMd) {
+  return `No restart is needed: a running Claude Code session picks it up. If one does not list it yet, read ${skillMd} and follow it, or run /reload-skills.`;
+}
 function describeInstall(name, r) {
   const lines = [
     `Installed ${name} version ${r.version} into ${r.dest} (${r.written.length} file(s)).`
@@ -2175,15 +2174,16 @@ function describeInstall(name, r) {
     lines.push(`Kept, edited here and no longer in the skill: ${r.keptEdited.join(", ")}`);
   }
   if (r.keptUntracked.length) lines.push(`Kept, added here: ${r.keptUntracked.join(", ")}`);
-  lines.push("Start a new Claude Code session to load it.");
+  lines.push(afterInstall(join5(r.dest, "SKILL.md")));
   return lines.join("\n");
 }
-var MANIFEST_FILE, ENTRY_FILE, MAX_FILES, MAX_FILE_BYTES, MAX_TOTAL_BYTES, NAME_RE, SEGMENT_RE, SKIPPED, SkillInstallRefused;
+var MANIFEST_FILE, ENTRY_FILE, PLUGIN_MANIFEST_FOLDER, MAX_FILES, MAX_FILE_BYTES, MAX_TOTAL_BYTES, NAME_RE, SEGMENT_RE, SKIPPED, SkillInstallRefused;
 var init_skills = __esm({
   "src/lib/skills.ts"() {
     "use strict";
     MANIFEST_FILE = ".systemdox-skill.json";
     ENTRY_FILE = "SKILL.md";
+    PLUGIN_MANIFEST_FOLDER = ".claude-plugin";
     MAX_FILES = 100;
     MAX_FILE_BYTES = 256 * 1024;
     MAX_TOTAL_BYTES = 1024 * 1024;
@@ -2301,7 +2301,7 @@ __export(plugin_path_exports, {
 });
 import { createHash as createHash4, randomBytes } from "crypto";
 import { existsSync as existsSync5 } from "fs";
-import { mkdir as mkdir5, rename as rename2, writeFile as writeFile5 } from "fs/promises";
+import { mkdir as mkdir6, rename as rename2, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname5, join as join6, resolve as resolve5, sep as sep2 } from "path";
 import { inflateRawSync } from "zlib";
 function parsePluginPathArgs(argv) {
@@ -2399,13 +2399,13 @@ async function unpackZip(zip, dest) {
     return full;
   });
   const data = entries2.map((e) => e.directory ? void 0 : entryData(zip, e));
-  await mkdir5(root, { recursive: true });
+  await mkdir6(root, { recursive: true });
   for (const [i, entry] of entries2.entries()) {
     if (entry.directory) {
-      await mkdir5(targets[i], { recursive: true });
+      await mkdir6(targets[i], { recursive: true });
       continue;
     }
-    await mkdir5(dirname5(targets[i]), { recursive: true });
+    await mkdir6(dirname5(targets[i]), { recursive: true });
     await writeFile5(targets[i], data[i], { mode: entry.mode ?? 420 });
   }
   return entries2.filter((e) => !e.directory).length;
@@ -2508,6 +2508,148 @@ var init_plugin_path = __esm({
   }
 });
 
+// src/lib/session-brief.ts
+import { existsSync as existsSync6 } from "fs";
+import { readFile as readFile5 } from "fs/promises";
+import { join as join7 } from "path";
+function noKey(reason) {
+  return `This computer has no SystemDox key it can use (${reason}), so the team's rules and skills cannot be read and every SystemDox tool fails. Tell the person once: \`${SETUP_COMMAND}\` in their own terminal asks for one.`;
+}
+function keyReason(message) {
+  if (/holds keys for/.test(message)) return "keys for several workspaces are stored; set SYSTEMDOX_WORKSPACE to the one to use";
+  if (/holds no key for/.test(message)) return "SYSTEMDOX_WORKSPACE names a workspace with no stored key";
+  if (/No SystemDox key/.test(message)) return "none is stored";
+  return "the stored keys could not be read";
+}
+function olderApi(setup) {
+  return `SystemDox workspace ${setup.workspace}. Before writing code in one of its repositories, call get_context with the task and the files you expect to touch, and obey what it returns. get_team_setup lists the team setup.`;
+}
+async function readJsonQuietly2(path) {
+  try {
+    return JSON.parse(await readFile5(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function computerState(setup) {
+  const id = `${setup.workspace}-setup@systemdox-${setup.workspace}`;
+  const installed = await readJsonQuietly2(join7(homeDir(), ".claude", "plugins", "installed_plugins.json"));
+  const entries2 = installed?.plugins?.[id];
+  const entry = Array.isArray(entries2) ? entries2.find((e) => (e?.scope ?? "user") === "user") : void 0;
+  const state = {
+    missing: [],
+    behind: [],
+    notFromSystemDox: [],
+    pluginInstalled: !!entry,
+    pluginVersion: entry?.version
+  };
+  const pluginCurrent = !!entry && !!setup.plugin && entry.version === `${setup.plugin.version}.0.0`;
+  for (const skill of setup.sessionBrief?.skills ?? []) {
+    const dir = defaultSkillDir(skill.name);
+    if (!existsSync6(dir)) {
+      if (!(pluginCurrent && setup.plugin?.skills?.[skill.name] !== void 0)) state.missing.push(skill.name);
+      continue;
+    }
+    const manifest = await readJsonQuietly2(join7(dir, MANIFEST_FILE));
+    if (typeof manifest?.version !== "number" || !Number.isInteger(manifest.version)) {
+      state.notFromSystemDox.push(skill.name);
+    } else if (manifest.version !== skill.latestVersion) {
+      state.behind.push({ name: skill.name, here: manifest.version, latest: skill.latestVersion });
+    }
+  }
+  return state;
+}
+function hasPersonParts(setup) {
+  return Object.keys(setup.parts ?? {}).length > 0 || (setup.memory ?? []).length > 0 || (setup.sessionBrief?.heldSkills ?? []).some((h) => h.reason === "not-plain");
+}
+function listWithin(items, room) {
+  const whole2 = items.join(", ");
+  if (whole2.length <= room) return whole2;
+  const kept = [];
+  let used = 0;
+  for (let i = 0; i < items.length; i++) {
+    const rest = items.length - i - 1;
+    const cost = items[i].length + (kept.length ? 2 : 0);
+    if (used + cost + ` and ${MORE(rest)}`.length > room) break;
+    kept.push(items[i]);
+    used += cost;
+  }
+  return kept.length ? `${kept.join(", ")} and ${MORE(items.length - kept.length)}` : `all ${MORE(items.length)}`;
+}
+function localSection(setup, state, room) {
+  const rest = hasPersonParts(setup) ? ` and that \`${SETUP_COMMAND}\` in their own terminal adds the rest of the team setup` : "";
+  const latest = new Map((setup.sessionBrief?.skills ?? []).map((s) => [s.name, s.latestVersion]));
+  const lines = [];
+  if (state.missing.length) {
+    lines.push({
+      head: "On this computer, missing: ",
+      items: state.missing.map((name) => `${name} version ${latest.get(name)}`),
+      tail: `. Install each now with install_skill at that version, before your first answer. Then tell the person what you installed${rest}. When a skill's line matches the request and it is not loaded yet, read ~/.claude/skills/<name>/SKILL.md and follow it.`
+    });
+  }
+  if (state.behind.length) {
+    lines.push({
+      head: "On this computer, behind: ",
+      items: state.behind.map((b) => `${b.name} (version ${b.here} here, latest ${b.latest})`),
+      tail: ". install_skill updates each to that latest version; if it refuses because files were edited, tell the person and leave them."
+    });
+  }
+  if (state.notFromSystemDox.length) {
+    lines.push({ head: "Not from SystemDox, left alone: ", items: state.notFromSystemDox, tail: "." });
+  }
+  const fixed = () => lines.reduce((n, l) => n + l.head.length + l.tail.length + LIST_MIN, 0) + Math.max(0, lines.length - 1);
+  while (lines.length && fixed() > room) lines.pop();
+  if (!lines.length) return "";
+  const share = Math.floor((room - fixed()) / lines.length) + LIST_MIN;
+  return lines.map((l) => `${l.head}${listWithin(l.items, share)}${l.tail}`).join("\n");
+}
+function fit(text3, section) {
+  const whole2 = section ? `${text3}
+
+${section}` : text3;
+  if (whole2.length <= INSTRUCTIONS_MAX) return whole2;
+  return text3.length <= INSTRUCTIONS_MAX ? text3 : `${text3.slice(0, INSTRUCTIONS_MAX - 1)}\u2026`;
+}
+async function readTeamSetup(apiClient2, { keyProblem: keyProblem2, timeoutMs = BRIEF_TIMEOUT_MS } = {}) {
+  if (keyProblem2) return { problem: noKey(keyProblem2) };
+  try {
+    const setup = await apiClient2.getOwnTeamSetup(AbortSignal.timeout(timeoutMs));
+    return typeof setup?.workspace === "string" ? { setup } : { problem: NOT_CHECKED };
+  } catch (err) {
+    const status = err?.status;
+    return { problem: status === 401 || status === 403 ? REFUSED : NOT_CHECKED };
+  }
+}
+async function sessionInstructions(apiClient2, options = {}) {
+  const read = await readTeamSetup(apiClient2, options);
+  if ("problem" in read) return read.problem;
+  const text3 = read.setup.sessionBrief?.text ?? olderApi(read.setup);
+  try {
+    if (!options.localFiles) return fit(text3, read.setup.sessionBrief?.skills?.length ? CANNOT_SEE : "");
+    const room = INSTRUCTIONS_MAX - text3.length - 2;
+    return fit(text3, localSection(read.setup, await computerState(read.setup), room));
+  } catch {
+    return fit(text3, "");
+  }
+}
+var INSTRUCTIONS_MAX, BRIEF_TIMEOUT_MS, NO_KEY, SETUP_COMMAND, REFUSED, NOT_CHECKED, CANNOT_SEE, MORE, LIST_MIN;
+var init_session_brief = __esm({
+  "src/lib/session-brief.ts"() {
+    "use strict";
+    init_skills();
+    init_team_setup_files();
+    INSTRUCTIONS_MAX = 2e3;
+    BRIEF_TIMEOUT_MS = 8e3;
+    NO_KEY = "no-key-on-this-computer";
+    SETUP_COMMAND = "npx -y @systemdox/mcp-server setup";
+    REFUSED = `SystemDox refused this computer's key, so the team's rules and skills cannot be read and every SystemDox tool fails. Tell the person once: a new key comes from the SystemDox console, Settings \u203A API keys, and \`${SETUP_COMMAND}\` in their own terminal stores it.`;
+    NOT_CHECKED = "SystemDox could not be read when this session started, so the team's skills were not checked. Call get_team_setup to check again before relying on them.";
+    CANNOT_SEE = "This server cannot see this computer's disk. For each skill listed under Team skills: if ~/.claude/skills/<name>/ is absent, or its .systemdox-skill.json names another version than get_team_setup lists, call install_skill with that version and write what it returns, unless the latest team plugin carries it. Leave a folder with no such file alone. If a file there differs from the hash that file holds for it, it was edited: ask the person before replacing it.";
+    MORE = (n) => `${n} more (get_team_setup lists them)`;
+    LIST_MIN = `all ${MORE(100)}`.length;
+  }
+});
+
 // src/lib/language.ts
 function detectLanguage(filePath) {
   const ext = filePath.slice(filePath.lastIndexOf("."));
@@ -2620,7 +2762,7 @@ var init_config_links = __esm({
 
 // src/tools/get-guardrails.ts
 import { z } from "zod";
-function registerGetGuardrails(server2, apiClient2) {
+function registerGetGuardrails(server, apiClient2) {
   const handler = async ({
     language,
     category,
@@ -2674,7 +2816,7 @@ ${text3}`
       ]
     };
   };
-  server2.registerTool(
+  server.registerTool(
     "get_checks",
     {
       title: "Get Checks",
@@ -2683,7 +2825,7 @@ ${text3}`
     },
     handler
   );
-  server2.registerTool(
+  server.registerTool(
     "get_guardrails",
     {
       title: "Get Checks (legacy name)",
@@ -2717,8 +2859,8 @@ var init_get_guardrails = __esm({
 
 // src/tools/get-specs.ts
 import { z as z2 } from "zod";
-function registerGetSpecs(server2, apiClient2) {
-  server2.registerTool(
+function registerGetSpecs(server, apiClient2) {
+  server.registerTool(
     "get_specs",
     {
       title: "Get Specs",
@@ -2808,8 +2950,8 @@ function matchGlob(path, pattern) {
   const regex = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\{\{GLOBSTAR\}\}/g, ".*");
   return new RegExp(`^${regex}$`).test(path);
 }
-function registerGetDocs(server2, apiClient2) {
-  server2.registerTool(
+function registerGetDocs(server, apiClient2) {
+  server.registerTool(
     "get_docs",
     {
       title: "Get Docs",
@@ -2912,8 +3054,8 @@ var init_get_docs = __esm({
 });
 
 // src/tools/get-tech-stack.ts
-function registerGetTechStack(server2, apiClient2) {
-  server2.registerTool(
+function registerGetTechStack(server, apiClient2) {
+  server.registerTool(
     "get_tech_stack",
     {
       title: "Get Tech Stack",
@@ -2968,8 +3110,8 @@ var init_get_tech_stack = __esm({
 
 // src/tools/get-planning-context.ts
 import { z as z4 } from "zod";
-function registerGetPlanningContext(server2, apiClient2) {
-  server2.registerTool(
+function registerGetPlanningContext(server, apiClient2) {
+  server.registerTool(
     "get_planning_context",
     {
       title: "Get Planning Context",
@@ -3003,7 +3145,7 @@ ${r.conventions.map((c) => `- ${c}`).join("\n")}` : "")
 ${repos}`);
       }
       if (ctx.dependencies.length > 0) {
-        const deps = ctx.dependencies.map((d) => `- ${d.from} \u2192 ${d.to}`).join("\n");
+        const deps = ctx.dependencies.map((d) => `- ${d.from} \u2192 ${d.to}${d.provenance === "inferred" ? " (inferred)" : ""}`).join("\n");
         sections.push(`## Cross-Repo Dependencies
 
 ${deps}`);
@@ -3083,8 +3225,8 @@ function formatItem(item2) {
   ${meta.join(" \xB7 ")}` : "") + (item2.url ? `
   ${item2.url}` : "");
 }
-function registerGetPlanBoard(server2, apiClient2) {
-  server2.registerTool(
+function registerGetPlanBoard(server, apiClient2) {
+  server.registerTool(
     "get_plan_board",
     {
       title: "Get Plan Board",
@@ -3341,8 +3483,8 @@ function formatChange(change) {
     briefVerdict(change.states)
   ].join("\n\n");
 }
-function registerGetChange(server2, apiClient2) {
-  server2.registerTool(
+function registerGetChange(server, apiClient2) {
+  server.registerTool(
     "get_change",
     {
       title: "Get Change",
@@ -3696,16 +3838,22 @@ async function hydrate(api, item2, meta) {
 }
 async function buildContext(api, { taskDescription, filePaths = [], maxTokens }) {
   const budget = maxTokens ?? DEFAULT_BUDGET;
+  const failures = [];
+  const orEmpty = (empty) => (err) => {
+    failures.push(err);
+    return empty;
+  };
   const [rawGuardrails, rawSpecs, docs, stack, rules, docRepos] = await Promise.all([
-    api.get("/v1/guardrails").catch(() => []),
-    api.get("/v1/specs").catch(() => []),
-    api.get("/v1/docs").catch(() => ({ items: [] })),
-    api.get("/v1/ai/settings/stack").catch(() => []),
-    api.get("/v1/standards/rules").catch(() => []),
+    api.get("/v1/guardrails").catch(orEmpty([])),
+    api.get("/v1/specs").catch(orEmpty([])),
+    api.get("/v1/docs").catch(orEmpty({ items: [] })),
+    api.get("/v1/ai/settings/stack").catch(orEmpty([])),
+    api.get("/v1/standards/rules").catch(orEmpty([])),
     // Capability states — FAIL-OPEN: an unreadable config (older backend, a
     // blip) gates nothing, it can never hide working context.
     api.get("/v1/doc-repos").catch(() => null)
   ]);
+  if (failures.length === 5) throw failures[0];
   const disabled = (key2) => docRepos?.capabilities?.[key2]?.status === "disabled";
   const guardrails = disabled("fitness") ? [] : rawGuardrails;
   const specs = disabled("requirements") && disabled("design") && disabled("specs") ? [] : rawSpecs;
@@ -3912,12 +4060,13 @@ _Ranked lower \u2014 fetch with \`get_specs\` / \`get_docs\` if you need them._
     guardrails: selectedGuardrails.length
   };
   if (sections.length === 0) {
-    return { text: "No relevant context found for this task.", stats };
+    const text3 = failures.length ? `No context found for this task, but ${failures.length} of 5 reads failed, so this is not an all-clear: the team's rules may not have been read.` : "No relevant context found for this task.";
+    return { text: text3, stats };
   }
   const footer = `
 
 ---
-_Context: ${itemsWithBody} full text, ${itemsListed} listed, ${stats.itemsOmitted} omitted \xB7 ~${tokensUsed} of ${budget} tokens` + (bodyFailures > 0 ? ` \xB7 ${bodyFailures} body fetch(es) failed` : "") + `_`;
+_Context: ${itemsWithBody} full text, ${itemsListed} listed, ${stats.itemsOmitted} omitted \xB7 ~${tokensUsed} of ${budget} tokens` + (bodyFailures > 0 ? ` \xB7 ${bodyFailures} body fetch(es) failed` : "") + (failures.length > 0 ? ` \xB7 ${failures.length} of 5 reads failed` : "") + `_`;
   return { text: body + footer, stats };
 }
 var DEFAULT_BUDGET, RESERVE_TOKENS, GUARDRAIL_SHARE, MIN_BODY_TOKENS, MAX_HYDRATED, MAX_TAIL, TAIL_SHARE, TRUNCATION_NOTICE_TOKENS, SECTION_STOP_WORDS;
@@ -3961,8 +4110,8 @@ var init_context_builder = __esm({
 
 // src/tools/get-context.ts
 import { z as z7 } from "zod";
-function registerGetContext(server2, apiClient2) {
-  server2.registerTool(
+function registerGetContext(server, apiClient2) {
+  server.registerTool(
     "get_context",
     {
       title: "Get Context",
@@ -3996,9 +4145,254 @@ var init_get_context = __esm({
   }
 });
 
-// src/tools/create-guardrail.ts
+// src/tools/get-team-setup.ts
+function describeSetup(setup) {
+  const lines = [`# Team setup of ${setup.workspace}`, ""];
+  const skills = setup.sessionBrief?.skills ?? [];
+  const held = setup.sessionBrief?.heldSkills ?? [];
+  lines.push(`## Skills a session installs by itself (${skills.length})`, "");
+  if (skills.length) {
+    for (const s of skills) lines.push(`- **${s.name}** version ${s.latestVersion}: ${s.description}`);
+  } else if (!setup.sessionBrief && setup.skills.length) {
+    lines.push(`- ${setup.skills.join(", ")}`);
+  } else {
+    lines.push("None.");
+  }
+  lines.push("");
+  if (held.length) {
+    lines.push(`## Skills that wait for the person (${held.length})`, "");
+    for (const h of held) lines.push(`- **${h.name}**: ${HELD_BECAUSE[h.reason] ?? h.reason}`);
+    lines.push("", "Do not install these yourself: each is the person's to decide.", "");
+  }
+  if (setup.plugin) {
+    lines.push(`## Team plugin`, "", `\`${setup.workspace}-setup\` version ${setup.plugin.version}.`);
+    for (const c of setup.plugin.hookCommands ?? []) lines.push(`- Hook: ${JSON.stringify(c)}`);
+    for (const m of setup.plugin.mcpServers ?? []) {
+      lines.push(`- MCP server ${JSON.stringify(m.name)}: ${JSON.stringify(m.url ?? [m.command, ...m.args ?? []].filter(Boolean).join(" "))}`);
+    }
+    lines.push("");
+  }
+  const parts = Object.entries(setup.parts ?? {});
+  if (parts.length) {
+    lines.push(`## Published parts`, "", ...parts.map(([p, v]) => `- ${p}: version ${v}`), "");
+  }
+  if (setup.memory?.length) {
+    lines.push(`## Team memory`, "", ...setup.memory.map((m) => `- ${m.project}: ${m.fileCount} file(s)`), "");
+  }
+  return lines;
+}
+function describeComputer(setup, state) {
+  const lines = ["## This computer", ""];
+  if (!setup.sessionBrief) {
+    return [...lines, "This SystemDox API is too old to compare this computer with the team setup."];
+  }
+  const skills = setup.sessionBrief.skills;
+  const latest = new Map(skills.map((s) => [s.name, s.latestVersion]));
+  lines.push(
+    state.missing.length ? `- Missing: ${state.missing.map((name) => `${name} version ${latest.get(name)}`).join(", ")}` : `- Missing: none of ${skills.length}`
+  );
+  if (state.behind.length) {
+    lines.push(`- Behind: ${state.behind.map((b) => `${b.name} (version ${b.here} here, latest ${b.latest})`).join(", ")}`);
+  }
+  if (state.notFromSystemDox.length) lines.push(`- Not from SystemDox, left alone: ${state.notFromSystemDox.join(", ")}`);
+  if (setup.plugin) {
+    lines.push(
+      state.pluginInstalled ? `- Team plugin: installed${state.pluginVersion ? `, ${state.pluginVersion}` : ""}; the latest is version ${setup.plugin.version}` : "- Team plugin: not installed"
+    );
+  }
+  lines.push("", "## What to do", "");
+  const steps = [];
+  if (state.missing.length) steps.push("Call install_skill for each missing skill, at the version named above. These are plain skills: installing writes files and runs nothing.");
+  if (state.behind.length) {
+    steps.push("Call install_skill for each skill behind, at the latest version named above. If it refuses because files were edited, tell the person and leave them.");
+  }
+  if (hasPersonParts(setup) && !state.pluginInstalled) {
+    steps.push(
+      `Hooks, MCP servers, team instructions and memory need the person: \`${SETUP_COMMAND}\` in their own terminal. Never answer its prompts for them.`
+    );
+  }
+  lines.push(...steps.length ? steps.map((s, i) => `${i + 1}. ${s}`) : ["Nothing."]);
+  return lines;
+}
+function registerGetTeamSetup(server, apiClient2, { localFiles, keyProblem: keyProblem2 }) {
+  server.registerTool(
+    "get_team_setup",
+    {
+      title: "Get Team Setup",
+      description: localFiles ? "What this workspace's team setup holds (skills, plugin, hooks, MCP servers, memory) and what this computer lacks, with what to do about it. Call it to check whether this computer is set up. Reads only." : "What this workspace's team setup holds (skills, plugin, hooks, MCP servers, memory), and how to check this computer against it. Reads only.",
+      inputSchema: {},
+      annotations: { readOnlyHint: true }
+    },
+    async () => {
+      const read = await readTeamSetup(apiClient2, { keyProblem: keyProblem2, timeoutMs: 15e3 });
+      if ("problem" in read) return { content: [{ type: "text", text: read.problem }] };
+      const lines = describeSetup(read.setup);
+      if (localFiles) lines.push(...describeComputer(read.setup, await computerState(read.setup)));
+      else lines.push(CANNOT_SEE);
+      return { content: [{ type: "text", text: lines.join("\n") }] };
+    }
+  );
+}
+var HELD_BECAUSE;
+var init_get_team_setup = __esm({
+  "src/tools/get-team-setup.ts"() {
+    "use strict";
+    init_session_brief();
+    HELD_BECAUSE = {
+      "not-plain": `it is not a plain skill: it has frontmatter beyond a name and a description, files outside its own folders, or a command that runs as it loads. The team plugin carries it, and \`${SETUP_COMMAND}\` shows that before the person accepts`,
+      "outside-default-space": "it is outside the default space, so the team plugin does not carry it either. The person can read it in the console, then install it with `npx -y @systemdox/mcp-server install-skill <name>`",
+      "not-checked": "it could not be checked. Ask again later"
+    };
+  }
+});
+
+// src/tools/document-graph.ts
 import { z as z8 } from "zod";
-function registerCreateGuardrail(server2, apiClient2) {
+function place(file, line) {
+  return file ? `${file}:${line}` : "made by a person";
+}
+function known(provenance, confidence) {
+  return `${provenance} ${confidence}`;
+}
+function formatNeighbours(answer) {
+  const lines = [`# ${answer.doc.label}`, `\`${answer.doc.id}\``, ""];
+  if (answer.links.length === 0) lines.push("No links.");
+  for (const link of answer.links) {
+    lines.push(
+      `- ${link.direction} \xB7 ${link.relation} \xB7 ${known(link.provenance, link.confidence)} \xB7 ${link.other.label} \xB7 \`${link.other.id}\` \xB7 ${place(link.file, link.line)}`
+    );
+  }
+  if (answer.truncated) {
+    lines.push("", `Showing ${answer.links.length} of ${answer.total}. Raise limit to see more.`);
+  }
+  if (answer.ambiguous.length > 0) {
+    lines.push("", "## Ambiguous: not drawn, because each could mean several documents");
+    for (const entry of answer.ambiguous) {
+      const candidates = entry.candidates.map((c) => `${c.label} (${c.repo}, \`${c.id}\`)`);
+      lines.push(`- ${entry.reference} at ${place(entry.file, entry.line)}: ${candidates.join("; ")}`);
+    }
+  }
+  return lines.join("\n");
+}
+function formatPath(answer, maxHops) {
+  if (!answer.found) return `No path within ${maxHops} hops.`;
+  const lines = answer.steps.map((step, index) => {
+    const arrow = step.reversed ? "<-" : "->";
+    return `${index + 1}. ${step.from.label} ${arrow} ${step.relation} ${arrow} ${step.to.label} \xB7 ${known(step.provenance, step.confidence)} \xB7 ${place(step.file, step.line)}`;
+  });
+  return [...lines, "", `Path confidence: ${answer.confidence}`].join("\n");
+}
+function formatStats(stats, repoLinks) {
+  const { declared, extracted, inferred, ambiguous } = stats.links;
+  const lines = [
+    `# The graph: ${stats.nodeCount} documents, ${stats.edgeCount} links`,
+    "",
+    `Links: ${declared} declared \xB7 ${extracted} extracted \xB7 ${inferred} inferred \xB7 ${ambiguous} ambiguous (not drawn)`,
+    "",
+    "## Repositories"
+  ];
+  for (const repo of stats.repos) {
+    const state = repo.behind ? `BEHIND: pushed ${repo.headCommit || "unknown"} at ${repo.pushedAt}, index at ${repo.indexedCommit || "unknown"}` : `index at ${repo.indexedCommit || "unknown"}`;
+    lines.push(`- ${repo.repo}: ${repo.documents} documents, ${repo.links} links, ${state}`);
+  }
+  if (repoLinks.length > 0) {
+    lines.push("", "## Repository links");
+    for (const link of repoLinks) {
+      lines.push(
+        `- ${link.source} ${link.relation} ${link.target} \xB7 ${known(link.provenance, link.confidence)} \xB7 ${place(link.file, link.line)}`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+function refused(err) {
+  const status = err.status;
+  if (status !== 404 && status !== 400) throw err;
+  return {
+    content: [{ type: "text", text: err.message }],
+    isError: true
+  };
+}
+function registerDocumentGraph(server, apiClient2) {
+  server.registerTool(
+    "get_document_links",
+    {
+      description: "What one document links to and from, strongest first. Each link says how it is known: declared (a person made it), extracted (the file says so), or inferred (a reading that could be wrong), with a confidence and the file and line it came from. A reference that could mean several documents is listed as ambiguous with its candidates, and is never drawn as a link. doc_id is the id get_docs returns. Read-only.",
+      inputSchema: {
+        doc_id: z8.string().min(1).max(400).describe("A document id, as get_docs returns it"),
+        direction: z8.enum(["out", "in", "both"]).optional().describe("Default both"),
+        relation: z8.enum(["links_to", "cites", "mentions", "satisfies", "references"]).optional().describe("Only links of this kind"),
+        limit: z8.number().int().min(1).max(MAX_LIMIT).optional().describe(`Most links to show (default ${DEFAULT_LIMIT2})`)
+      },
+      annotations: { readOnlyHint: true }
+    },
+    async ({ doc_id, direction, relation, limit }) => {
+      const params = { doc: doc_id, limit: String(limit ?? DEFAULT_LIMIT2) };
+      if (direction) params.direction = direction;
+      if (relation) params.relation = relation;
+      try {
+        const answer = await apiClient2.get("/v1/graph/neighbours", params);
+        return { content: [{ type: "text", text: formatNeighbours(answer) }] };
+      } catch (err) {
+        return refused(err);
+      }
+    }
+  );
+  server.registerTool(
+    "trace_document_path",
+    {
+      description: "The shortest way two documents connect, walking links in either direction. Each step says how it is known, and the path is only as strong as its weakest step. Read-only.",
+      inputSchema: {
+        from: z8.string().min(1).max(400).describe("A document id, as get_docs returns it"),
+        to: z8.string().min(1).max(400).describe("A document id, as get_docs returns it"),
+        max_hops: z8.number().int().min(1).max(MAX_HOPS).optional().describe(`Longest path to look for (default ${DEFAULT_HOPS})`)
+      },
+      annotations: { readOnlyHint: true }
+    },
+    async ({ from, to, max_hops }) => {
+      const hops = max_hops ?? DEFAULT_HOPS;
+      try {
+        const answer = await apiClient2.get("/v1/graph/path", {
+          from,
+          to,
+          maxHops: String(hops)
+        });
+        return { content: [{ type: "text", text: formatPath(answer, hops) }] };
+      } catch (err) {
+        return refused(err);
+      }
+    }
+  );
+  server.registerTool(
+    "get_graph_stats",
+    {
+      description: "The state of the graph: links counted by how they are known, each repository's freshness (marked BEHIND when a push has not finished indexing), and how repositories depend on each other, from the files that declare it. Read-only.",
+      inputSchema: {},
+      annotations: { readOnlyHint: true }
+    },
+    async () => {
+      const [stats, repos] = await Promise.all([
+        apiClient2.getFresh("/v1/graph/stats"),
+        apiClient2.getFresh("/v1/graph/repos")
+      ]);
+      return { content: [{ type: "text", text: formatStats(stats, repos.links) }] };
+    }
+  );
+}
+var DEFAULT_LIMIT2, MAX_LIMIT, DEFAULT_HOPS, MAX_HOPS;
+var init_document_graph = __esm({
+  "src/tools/document-graph.ts"() {
+    "use strict";
+    DEFAULT_LIMIT2 = 50;
+    MAX_LIMIT = 200;
+    DEFAULT_HOPS = 6;
+    MAX_HOPS = 8;
+  }
+});
+
+// src/tools/create-guardrail.ts
+import { z as z9 } from "zod";
+function registerCreateGuardrail(server, apiClient2) {
   const handler = async ({
     title,
     description,
@@ -4035,7 +4429,7 @@ function registerCreateGuardrail(server2, apiClient2) {
       ]
     };
   };
-  server2.registerTool(
+  server.registerTool(
     "create_check",
     {
       title: "Create Check",
@@ -4047,7 +4441,7 @@ function registerCreateGuardrail(server2, apiClient2) {
     },
     handler
   );
-  server2.registerTool(
+  server.registerTool(
     "create_guardrail",
     {
       title: "Create Check (legacy name)",
@@ -4077,32 +4471,32 @@ var init_create_guardrail = __esm({
       "data-access"
     ];
     inputSchema2 = () => ({
-      title: z8.string().describe("Short title for the check"),
-      description: z8.string().describe("Detailed description of what the check enforces and why"),
-      severity: z8.enum(["critical", "high", "medium", "low"]).describe("Severity level"),
-      category: z8.enum(CATEGORIES).optional().describe("Category (defaults to conventions)"),
-      pattern: z8.string().optional().describe("Bad code pattern that should be avoided"),
-      fix: z8.string().optional().describe("Correct code pattern to use instead"),
-      fitness_test: z8.string().optional().describe("Shell command to detect violations in CI")
+      title: z9.string().describe("Short title for the check"),
+      description: z9.string().describe("Detailed description of what the check enforces and why"),
+      severity: z9.enum(["critical", "high", "medium", "low"]).describe("Severity level"),
+      category: z9.enum(CATEGORIES).optional().describe("Category (defaults to conventions)"),
+      pattern: z9.string().optional().describe("Bad code pattern that should be avoided"),
+      fix: z9.string().optional().describe("Correct code pattern to use instead"),
+      fitness_test: z9.string().optional().describe("Shell command to detect violations in CI")
     });
   }
 });
 
 // src/tools/update-spec.ts
-import { z as z9 } from "zod";
-function registerUpdateSpec(server2, apiClient2) {
-  server2.registerTool(
+import { z as z10 } from "zod";
+function registerUpdateSpec(server, apiClient2) {
+  server.registerTool(
     "update_spec",
     {
       title: "Update Spec",
       description: "Update an existing SystemDox spec's proposal, tasks, or requirements. Only draft specs can be modified \u2014 published specs must be versioned first.",
       inputSchema: {
-        draft_id: z9.string().describe("ID of the spec to update"),
-        section: z9.enum(["proposal", "tasks", "requirements"]).describe("Which section to update"),
-        content: z9.string().describe(
+        draft_id: z10.string().describe("ID of the spec to update"),
+        section: z10.enum(["proposal", "tasks", "requirements"]).describe("Which section to update"),
+        content: z10.string().describe(
           "New markdown content for the section. For requirements, provide the full requirement content."
         ),
-        requirement_name: z9.string().optional().describe(
+        requirement_name: z10.string().optional().describe(
           "Name of the requirement (required when section is 'requirements')"
         )
       },
@@ -4157,19 +4551,19 @@ var init_update_spec = __esm({
 });
 
 // src/tools/report-decision.ts
-import { z as z10 } from "zod";
-function registerReportDecision(server2, apiClient2) {
-  server2.registerTool(
+import { z as z11 } from "zod";
+function registerReportDecision(server, apiClient2) {
+  server.registerTool(
     "report_decision",
     {
       title: "Report Decision",
       description: "Record an architecture decision made during development. Creates a draft ADR in SystemDox for human review.",
       inputSchema: {
-        title: z10.string().describe("Decision title (e.g., 'Use WebSocket for real-time updates')"),
-        context: z10.string().describe("What prompted this decision \u2014 the problem or constraint"),
-        decision: z10.string().describe("What was decided and why"),
-        consequences: z10.string().describe("What this decision means going forward \u2014 trade-offs, follow-up work"),
-        related_files: z10.array(z10.string()).optional().describe("File paths related to this decision")
+        title: z11.string().describe("Decision title (e.g., 'Use WebSocket for real-time updates')"),
+        context: z11.string().describe("What prompted this decision \u2014 the problem or constraint"),
+        decision: z11.string().describe("What was decided and why"),
+        consequences: z11.string().describe("What this decision means going forward \u2014 trade-offs, follow-up work"),
+        related_files: z11.array(z11.string()).optional().describe("File paths related to this decision")
       },
       annotations: {
         readOnlyHint: false
@@ -4225,15 +4619,15 @@ var init_report_decision = __esm({
 });
 
 // src/tools/get-project-rules.ts
-import { z as z11 } from "zod";
-function registerGetProjectRules(server2, apiClient2) {
-  server2.registerTool(
+import { z as z12 } from "zod";
+function registerGetProjectRules(server, apiClient2) {
+  server.registerTool(
     "get_project_rules",
     {
       title: "Get Project Rules",
       description: "Retrieve project rules defined in SystemDox Standards. These are team-defined principles covering deployment, architecture, security, testing, and process. Filter by category to get only relevant rules.",
       inputSchema: {
-        category: z11.enum(["deployment", "architecture", "security", "testing", "process", "other"]).optional().describe("Filter by rule category")
+        category: z12.enum(["deployment", "architecture", "security", "testing", "process", "other"]).optional().describe("Filter by rule category")
       }
     },
     async ({ category }) => {
@@ -4300,18 +4694,18 @@ var init_get_project_rules = __esm({
 });
 
 // src/tools/create-project-rule.ts
-import { z as z12 } from "zod";
-function registerCreateProjectRule(server2, apiClient2) {
-  server2.registerTool(
+import { z as z13 } from "zod";
+function registerCreateProjectRule(server, apiClient2) {
+  server.registerTool(
     "create_project_rule",
     {
       title: "Create Project Rule",
       description: "Create a new project rule in SystemDox Standards. Use this when you discover a team principle or convention that should be enforced across the project.",
       inputSchema: {
-        text: z12.string().describe(
+        text: z13.string().describe(
           "The rule statement \u2014 one enforceable principle per rule (e.g. 'All deployments MUST go through GitHub Actions workflows')"
         ),
-        category: z12.enum(["deployment", "architecture", "security", "testing", "process", "other"]).describe("Rule category")
+        category: z13.enum(["deployment", "architecture", "security", "testing", "process", "other"]).describe("Rule category")
       },
       annotations: {
         readOnlyHint: false
@@ -4341,8 +4735,8 @@ var init_create_project_rule = __esm({
 });
 
 // src/tools/get-prompt-templates.ts
-function registerGetPromptTemplates(server2, apiClient2) {
-  server2.registerTool(
+function registerGetPromptTemplates(server, apiClient2) {
+  server.registerTool(
     "get_prompt_templates",
     {
       title: "Get Prompt Templates",
@@ -4393,17 +4787,17 @@ var init_get_prompt_templates = __esm({
 });
 
 // src/tools/create-prompt-template.ts
-import { z as z13 } from "zod";
-function registerCreatePromptTemplate(server2, apiClient2) {
-  server2.registerTool(
+import { z as z14 } from "zod";
+function registerCreatePromptTemplate(server, apiClient2) {
+  server.registerTool(
     "create_prompt_template",
     {
       title: "Create Prompt Template",
       description: "Create a new reusable prompt template in SystemDox Standards. Use this to store preconfigured prompts for common AI tasks like code reviews, documentation generation, or analysis frameworks.",
       inputSchema: {
-        name: z13.string().describe("Short name for the template"),
-        description: z13.string().optional().describe("Brief description of when to use this template"),
-        prompt: z13.string().describe("The full prompt text that Gen AI will use when generating content")
+        name: z14.string().describe("Short name for the template"),
+        description: z14.string().optional().describe("Brief description of when to use this template"),
+        prompt: z14.string().describe("The full prompt text that Gen AI will use when generating content")
       },
       annotations: {
         readOnlyHint: false
@@ -4437,7 +4831,7 @@ var init_create_prompt_template = __esm({
 });
 
 // src/tools/skills.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 import { homedir as homedir3 } from "os";
 import { basename as basename2, resolve as resolve6 } from "path";
 function expandHome(path) {
@@ -4446,25 +4840,25 @@ function expandHome(path) {
 function text(t) {
   return { content: [{ type: "text", text: t }] };
 }
-function registerSkillTools(server2, apiClient2, { localFiles }) {
-  const fileSchema = z14.object({
-    path: z14.string().describe('Path inside the skill folder, forward slashes, e.g. "references/guide.md"'),
-    content: z14.string().describe("The file's full text, exactly as it is")
+function registerSkillTools(server, apiClient2, { localFiles }) {
+  const fileSchema = z15.object({
+    path: z15.string().describe('Path inside the skill folder, forward slashes, e.g. "references/guide.md"'),
+    content: z15.string().describe("The file's full text, exactly as it is")
   });
-  server2.registerTool(
+  server.registerTool(
     "publish_skill",
     {
       title: "Publish Skill",
       description: localFiles ? "Publish a Claude Code skill folder (SKILL.md plus its references and scripts) to SystemDox so it can be installed on any computer. Pass `directory` (e.g. ~/.claude/skills/<name>): the server reads the files itself, byte for byte. Publishing a name again makes a new version. Never retype the files into `files` when the folder is on this computer." : "Publish a Claude Code skill (SKILL.md plus its references and scripts) to SystemDox so it can be installed on any computer. Pass every file of the folder in `files`, exactly as it is. Publishing a name again makes a new version.",
       inputSchema: {
         ...localFiles ? {
-          directory: z14.string().optional().describe("The skill folder on this computer, holding SKILL.md at its root")
+          directory: z15.string().optional().describe("The skill folder on this computer, holding SKILL.md at its root")
         } : {},
-        files: z14.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the skill folder"),
-        name: z14.string().optional().describe("The skill's name; defaults to SKILL.md's frontmatter name and must match it"),
-        spaceId: z14.string().optional().describe("Space for a NEW skill (default: your default space)"),
-        note: z14.string().max(500).optional().describe(`A short change note for this version, shown in the console's history (e.g. "Fix the GA4 step")`),
-        baseVersion: z14.number().int().positive().optional().describe(
+        files: z15.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the skill folder"),
+        name: z15.string().optional().describe("The skill's name; defaults to SKILL.md's frontmatter name and must match it"),
+        spaceId: z15.string().optional().describe("Space for a NEW skill (default: your default space)"),
+        note: z15.string().max(500).optional().describe(`A short change note for this version, shown in the console's history (e.g. "Fix the GA4 step")`),
+        baseVersion: z15.number().int().positive().optional().describe(
           "The version these files were edited from. When given, the publish is refused (SYD-K017) if someone published a newer version since, instead of replacing their changes"
         )
       },
@@ -4502,7 +4896,7 @@ Left out (hidden files are never part of a skill): ${skipped.join(", ")}` : "")
       );
     }
   );
-  server2.registerTool(
+  server.registerTool(
     "list_skills",
     {
       title: "List Skills",
@@ -4524,16 +4918,16 @@ Left out (hidden files are never part of a skill): ${skipped.join(", ")}` : "")
       );
     }
   );
-  server2.registerTool(
+  server.registerTool(
     "install_skill",
     {
       title: "Install Skill",
       description: localFiles ? "Install a skill published to SystemDox onto this computer (default ~/.claude/skills/<name>/). Refuses, naming the files, when a file there was edited since it was installed, unless overwrite is true. Never runs anything." : "Fetch a skill published to SystemDox so you can install it: returns every file and the folder to write them into (default ~/.claude/skills/<name>/). Write each file exactly, then the manifest it shows.",
       inputSchema: {
-        name: z14.string().describe("The skill's name"),
-        version: z14.number().int().positive().optional().describe("A version number (default: the latest)"),
-        target: z14.string().optional().describe("Folder to install into, e.g. a repo's .claude/skills/<name>"),
-        ...localFiles ? { overwrite: z14.boolean().optional().describe("Replace files edited since they were installed") } : {}
+        name: z15.string().describe("The skill's name"),
+        version: z15.number().int().positive().optional().describe("A version number (default: the latest)"),
+        target: z15.string().optional().describe("Folder to install into, e.g. a repo's .claude/skills/<name>"),
+        ...localFiles ? { overwrite: z15.boolean().optional().describe("Replace files edited since they were installed") } : {}
       },
       annotations: { readOnlyHint: !localFiles }
     },
@@ -4564,7 +4958,7 @@ ${fence}
 ${f.content}${f.content.endsWith("\n") ? "" : "\n"}${fence}`;
       }).join("\n\n");
       return text(
-        `Skill **${version.name}** version ${version.version}: write these ${version.files.length} file(s) into ${dest}/ exactly as shown (the content between the fences), creating folders as needed. If a file there differs from ${MANIFEST_FILE}'s hash for it, it was edited: ask before replacing it. Then write ${MANIFEST_FILE} with this content, and tell the user to start a new Claude Code session.
+        `Skill **${version.name}** version ${version.version}: write these ${version.files.length} file(s) into ${dest}/ exactly as shown (the content between the fences), creating folders as needed. If a file there differs from ${MANIFEST_FILE}'s hash for it, it was edited: ask before replacing it. Then write ${MANIFEST_FILE} with this content. ${afterInstall(`${dest}/SKILL.md`)}
 
 ### ${MANIFEST_FILE}
 
@@ -4599,11 +4993,11 @@ var init_team_setup_types = __esm({
 });
 
 // src/tools/team-setup.ts
-import { z as z15 } from "zod";
-import { existsSync as existsSync6 } from "fs";
+import { z as z16 } from "zod";
+import { existsSync as existsSync7 } from "fs";
 import { lstat as lstat2 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { join as join7, resolve as resolve7 } from "path";
+import { join as join8, resolve as resolve7 } from "path";
 function expandHome2(path) {
   return path.replace(/^~(?=$|[\\/])/, homedir4());
 }
@@ -4629,21 +5023,21 @@ async function readPartDirectory(part, directory) {
     let present = true;
     for (let i = 1; i <= segments.length; i++) {
       const rel = segments.slice(0, i).join("/");
-      if (await isLink(join7(root, ...segments.slice(0, i)))) {
+      if (await isLink(join8(root, ...segments.slice(0, i)))) {
         links.push(rel);
         present = false;
         break;
       }
     }
-    if (present && existsSync6(join7(root, ...segments))) paths.push(path);
+    if (present && existsSync7(join8(root, ...segments))) paths.push(path);
   }
   for (const { dir, md } of layout.folders) {
-    const full = join7(root, dir);
+    const full = join8(root, dir);
     if (await isLink(full)) {
       links.push(dir);
       continue;
     }
-    if (!existsSync6(full)) continue;
+    if (!existsSync7(full)) continue;
     const walked = await walk(full, { skipHidden: true });
     links.push(...walked.links.map((p) => `${dir}/${p}`));
     leftOut.push(...walked.hidden.map((p) => `${dir}/${p}`));
@@ -4682,24 +5076,24 @@ function describePerson(id, person) {
   );
   return lines.join("\n");
 }
-function registerTeamSetupTools(server2, apiClient2, { localFiles }) {
-  const fileSchema = z15.object({
-    path: z15.string().describe(`Path inside the part's folder, forward slashes, e.g. "hooks/hooks.json"`),
-    content: z15.string().describe("The file's full text, exactly as it is")
+function registerTeamSetupTools(server, apiClient2, { localFiles }) {
+  const fileSchema = z16.object({
+    path: z16.string().describe(`Path inside the part's folder, forward slashes, e.g. "hooks/hooks.json"`),
+    content: z16.string().describe("The file's full text, exactly as it is")
   });
-  server2.registerTool(
+  server.registerTool(
     "publish_setup_part",
     {
       title: "Publish Setup Part",
       description: "Publish one part of your team's Claude Code setup to SystemDox: `hooks` (hooks/hooks.json and the scripts/ it calls), `mcp` (.mcp.json), `agents` (agents/*.md), `commands` (commands/*.md) or `instructions` (CLAUDE.md). Every part but instructions makes a new version of the team plugin, which each member accepts at their next update. Publishing hooks, mcp, agents or commands needs the admin role. " + (localFiles ? "Pass `directory`: the server reads only the files the part accepts, byte for byte, and refuses a link, a binary file or a file too large before anything is sent. Never retype the files into `files` when the folder is on this computer." : "Pass every file of the part in `files`, exactly as it is."),
       inputSchema: {
-        part: z15.enum(PARTS2).describe("Which part of the setup"),
+        part: z16.enum(PARTS2).describe("Which part of the setup"),
         ...localFiles ? {
-          directory: z15.string().optional().describe(
+          directory: z16.string().optional().describe(
             "The folder on this computer: for hooks, the one holding hooks/hooks.json and scripts/; for mcp, the one holding .mcp.json; for instructions, the one holding CLAUDE.md; for agents or commands, the one holding agents/ or commands/"
           )
         } : {},
-        files: z15.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the part")
+        files: z16.array(fileSchema).optional().describe(localFiles ? "Only when there is no folder to read" : "Every file of the part")
       },
       annotations: { readOnlyHint: false }
     },
@@ -4729,13 +5123,13 @@ function registerTeamSetupTools(server2, apiClient2, { localFiles }) {
       return text2(lines.join("\n"));
     }
   );
-  server2.registerTool(
+  server.registerTool(
     "resolve_person",
     {
       title: "Resolve Person",
       description: "Read back a person that a team memory names by identifier, written as `con_\u2026` (label), `ctc_\u2026` or `usr_\u2026`: their label, name, phone number and email address, from the vault that holds them. The details are for this session only: never write them into a memory file; the memory keeps the identifier. Writes nothing.",
       inputSchema: {
-        id: z15.string().regex(PERSON_ID_RE, "a con_, ctc_ or usr_ identifier, as written in the memory").describe("The identifier, e.g. con_01JC2Q8Y4M7T0X3K5N9P2R6S8V")
+        id: z16.string().regex(PERSON_ID_RE, "a con_, ctc_ or usr_ identifier, as written in the memory").describe("The identifier, e.g. con_01JC2Q8Y4M7T0X3K5N9P2R6S8V")
       },
       annotations: { readOnlyHint: true }
     },
@@ -4746,14 +5140,14 @@ function registerTeamSetupTools(server2, apiClient2, { localFiles }) {
     }
   );
   if (!localFiles) return;
-  server2.registerTool(
+  server.registerTool(
     "sync_memory",
     {
       title: "Sync Memory",
       description: `Sync one project's team memory on this computer with SystemDox: pull the files the team changed, push the ones changed here, keep both texts of a file changed on both sides. It never answers for a person: a file that still holds a phone number, an email address or a home-folder path is skipped and listed, with the command for the member to run in their own terminal (\`${SYNC_MEMORY_COMMAND}\`). Pass dryRun to see what it would do without writing or sending anything.`,
       inputSchema: {
-        project: z15.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "a project name: lower case letters, digits and -").optional().describe("The project's team memory, e.g. puglieseweb-ltd; needed when the workspace has more than one"),
-        dryRun: z15.boolean().optional().describe("Show what would be pulled, pushed, deleted, conflicted and skipped, and change nothing")
+        project: z16.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "a project name: lower case letters, digits and -").optional().describe("The project's team memory, e.g. puglieseweb-ltd; needed when the workspace has more than one"),
+        dryRun: z16.boolean().optional().describe("Show what would be pulled, pushed, deleted, conflicted and skipped, and change nothing")
       },
       annotations: { readOnlyHint: false }
     },
@@ -4788,29 +5182,34 @@ var init_team_setup = __esm({
 
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-function createServer(apiClient2, { localFiles = false } = {}) {
-  const server2 = new McpServer({
-    name: "systemdox-mcp-server",
-    version: SERVER_VERSION
-  });
-  registerGetGuardrails(server2, apiClient2);
-  registerGetSpecs(server2, apiClient2);
-  registerGetDocs(server2, apiClient2);
-  registerGetTechStack(server2, apiClient2);
-  registerGetPlanningContext(server2, apiClient2);
-  registerGetPlanBoard(server2, apiClient2);
-  registerGetChange(server2, apiClient2);
-  registerGetContext(server2, apiClient2);
-  registerGetProjectRules(server2, apiClient2);
-  registerGetPromptTemplates(server2, apiClient2);
-  registerCreateGuardrail(server2, apiClient2);
-  registerUpdateSpec(server2, apiClient2);
-  registerReportDecision(server2, apiClient2);
-  registerCreateProjectRule(server2, apiClient2);
-  registerCreatePromptTemplate(server2, apiClient2);
-  registerSkillTools(server2, apiClient2, { localFiles });
-  registerTeamSetupTools(server2, apiClient2, { localFiles });
-  return server2;
+function createServer(apiClient2, { localFiles = false, instructions, keyProblem: keyProblem2 } = {}) {
+  const server = new McpServer(
+    {
+      name: "systemdox-mcp-server",
+      version: SERVER_VERSION
+    },
+    instructions ? { instructions } : void 0
+  );
+  registerGetGuardrails(server, apiClient2);
+  registerGetSpecs(server, apiClient2);
+  registerGetDocs(server, apiClient2);
+  registerGetTechStack(server, apiClient2);
+  registerGetPlanningContext(server, apiClient2);
+  registerGetPlanBoard(server, apiClient2);
+  registerGetChange(server, apiClient2);
+  registerGetContext(server, apiClient2);
+  registerGetProjectRules(server, apiClient2);
+  registerGetPromptTemplates(server, apiClient2);
+  registerGetTeamSetup(server, apiClient2, { localFiles, keyProblem: keyProblem2 });
+  registerDocumentGraph(server, apiClient2);
+  registerCreateGuardrail(server, apiClient2);
+  registerUpdateSpec(server, apiClient2);
+  registerReportDecision(server, apiClient2);
+  registerCreateProjectRule(server, apiClient2);
+  registerCreatePromptTemplate(server, apiClient2);
+  registerSkillTools(server, apiClient2, { localFiles });
+  registerTeamSetupTools(server, apiClient2, { localFiles });
+  return server;
 }
 var SERVER_VERSION;
 var init_server = __esm({
@@ -4824,6 +5223,8 @@ var init_server = __esm({
     init_get_plan_board();
     init_get_change();
     init_get_context();
+    init_get_team_setup();
+    init_document_graph();
     init_create_guardrail();
     init_update_spec();
     init_report_decision();
@@ -4833,7 +5234,7 @@ var init_server = __esm({
     init_create_prompt_template();
     init_skills2();
     init_team_setup();
-    SERVER_VERSION = true ? "0.1.49" : "0.0.0-dev";
+    SERVER_VERSION = true ? "0.1.51" : "0.0.0-dev";
   }
 });
 
@@ -4846,15 +5247,18 @@ __export(index_exports, {
 });
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 async function main() {
-  await apiClient.validate();
+  const instructions = await sessionInstructions(apiClient, { localFiles: true, keyProblem });
+  const server = createServer(apiClient, { localFiles: true, instructions, keyProblem });
   const transport = new StdioServerTransport();
   await server.connect(transport);
 }
-var config, apiClient, server;
+var config, keyProblem, apiClient;
 var init_index = __esm({
   async "src/index.ts"() {
     "use strict";
     init_api_client();
+    init_config();
+    init_session_brief();
     init_team_setup_files();
     init_server();
     init_server();
@@ -4862,10 +5266,15 @@ var init_index = __esm({
       config = await loadLocalConfig();
     } catch (err) {
       console.error(`SystemDox MCP server: ${err.message}`);
-      process.exit(1);
+      keyProblem = keyReason(err.message);
+      try {
+        config = loadConfig(NO_KEY);
+      } catch (urlErr) {
+        console.error(`SystemDox MCP server: ${urlErr.message}`);
+        process.exit(1);
+      }
     }
     apiClient = new SystemDoxApiClient(config);
-    server = createServer(apiClient, { localFiles: true });
     main();
   }
 });