@systemdox/mcp-server 0.1.54 → 0.1.56

package/dist/http.js

@@ -1,8 +1,5 @@
 #!/usr/bin/env node
 
-// src/http.ts
-import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-
 // src/lib/cache.ts
 var ResponseCache = class {
   store = /* @__PURE__ */ new Map();
@@ -54,6 +51,17 @@ var SystemDoxApiError = class extends Error {
   code;
   body;
 };
+function unescapedPath(path) {
+  let current = path.split(/[?#]/, 1)[0];
+  for (; ; ) {
+    const next = current.replace(/[\t\n\r]/g, "").replace(/%(?:2e|2f|5c|25|09|0a|0d)/gi, (escape) => decodeURIComponent(escape));
+    if (next === current) return current;
+    current = next;
+  }
+}
+function walksThePath(path) {
+  return unescapedPath(path).split(/[/\\]/).some((segment) => segment === "." || segment === "..");
+}
 var TEAM_SETUP = "/v1/team-setup";
 var seg = (s) => encodeURIComponent(String(s));
 var SystemDoxApiClient = class {
@@ -89,7 +97,7 @@ var SystemDoxApiClient = class {
   }
   async mutate(method, path, body) {
     const url = this.buildUrl(path);
-    const res = await fetch(url, {
+    const res = await this.call(url, {
       method,
       headers: {
         // The API Gateway authorizer only reads the Authorization header;
@@ -139,7 +147,7 @@ var SystemDoxApiClient = class {
   /** getPluginZip: the zip's bytes as served, and its X-Content-SHA256
    * header. The caller checks the BYTES against the hash it was given. */
   async getPluginZip(workspace, version) {
-    const res = await fetch(
+    const res = await this.call(
       this.buildUrl(`${TEAM_SETUP}/${seg(workspace)}/plugin/versions/${seg(version)}/zip`),
       {
         headers: {
@@ -205,6 +213,10 @@ var SystemDoxApiClient = class {
   buildUrl(path, params) {
     const base = this.config.apiUrl.replace(/\/+$/, "");
     const url = new URL(`${base}${path.startsWith("/") ? "" : "/"}${path}`);
+    const { origin, pathname } = new URL(base);
+    if (walksThePath(path) || url.origin !== origin || !url.pathname.startsWith(`${pathname.replace(/\/+$/, "")}/`)) {
+      throw new Error("Refused: this id leaves the API's own path.");
+    }
     if (params) {
       for (const [key, value] of Object.entries(params)) {
         url.searchParams.set(key, value);
@@ -214,7 +226,7 @@ var SystemDoxApiClient = class {
   }
   async fetchRaw(path, params, signal) {
     const url = this.buildUrl(path, params);
-    return fetch(url, {
+    return this.call(url, {
       headers: {
         Authorization: `Bearer ${this.config.apiKey}`,
         "X-API-Key": this.config.apiKey,
@@ -223,6 +235,16 @@ var SystemDoxApiClient = class {
       signal
     });
   }
+  /** Every call of this client, so `onAnswer` hears each answer. */
+  async call(url, init) {
+    const res = await fetch(url, init);
+    const { onAnswer } = this.config;
+    if (onAnswer) {
+      const refused2 = res.ok ? void 0 : new SystemDoxApiError(res.status, await res.clone().text());
+      onAnswer({ status: res.status, code: refused2?.code });
+    }
+    return res;
+  }
 };
 
 // src/lib/config.ts
@@ -244,714 +266,298 @@ function requireHttpsApiUrl(apiUrl) {
   return apiUrl;
 }
 
-// src/lib/metrics.ts
-var NAMESPACE = "SystemDox/Mcp";
-var METRIC_NAME = "McpToolCall";
-function buildMcpToolCallMetric(tenant, tool, timestamp = Date.now()) {
-  return {
-    _aws: {
-      Timestamp: timestamp,
-      CloudWatchMetrics: [
-        {
-          Namespace: NAMESPACE,
-          Dimensions: [["tenant"]],
-          Metrics: [{ Name: METRIC_NAME, Unit: "Count" }]
-        }
-      ]
-    },
-    tenant,
-    tool,
-    [METRIC_NAME]: 1
-  };
-}
-function emitMcpToolCalls(tenant, rawBody, log = console.log) {
-  try {
-    const parsed = JSON.parse(rawBody);
-    const messages = Array.isArray(parsed) ? parsed : [parsed];
-    for (const message of messages) {
-      if (typeof message === "object" && message !== null && message.method === "tools/call") {
-        const params = message.params;
-        const tool = typeof params?.name === "string" ? params.name : "unknown";
-        log(JSON.stringify(buildMcpToolCallMetric(tenant || "unknown", tool)));
-      }
-    }
-  } catch {
-  }
-}
+// src/lib/mcp-answer.ts
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
-// src/lib/session-brief.ts
-import { existsSync as existsSync2 } from "fs";
-import { readFile as readFile3 } from "fs/promises";
-import { join as join3 } from "path";
+// src/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
-// src/lib/skills.ts
-import { createHash } from "crypto";
-import { lstat, mkdir, readdir, readFile, rm, writeFile } from "fs/promises";
-import { existsSync } from "fs";
-import { homedir } from "os";
-import { dirname, join, relative, resolve, sep } from "path";
-var MANIFEST_FILE = ".systemdox-skill.json";
-var ENTRY_FILE = "SKILL.md";
-var PLUGIN_MANIFEST_FOLDER = ".claude-plugin";
-var MAX_FILES = 100;
-var MAX_FILE_BYTES = 256 * 1024;
-var MAX_TOTAL_BYTES = 1024 * 1024;
-var NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-var SEGMENT_RE = /^[A-Za-z0-9._-]+$/;
-var SKIPPED = /* @__PURE__ */ new Set([MANIFEST_FILE, ".git", "node_modules", "__pycache__", ".DS_Store"]);
-var SkillInstallRefused = class extends Error {
-  constructor(dest, edited) {
-    super(
-      `${dest} has local changes in ${edited.length} file(s): ${edited.join(", ")}. Nothing was written. Move your changes aside, or install again with overwrite.`
-    );
-    this.dest = dest;
-    this.edited = edited;
-  }
-  dest;
-  edited;
+// src/tools/get-guardrails.ts
+import { z } from "zod";
+
+// src/lib/language.ts
+var EXTENSION_MAP = {
+  ".py": { language: "python", categories: ["api", "backend", "data-access"] },
+  ".ts": { language: "typescript", categories: ["frontend", "api"] },
+  ".tsx": { language: "typescript", categories: ["frontend"] },
+  ".js": { language: "javascript", categories: ["frontend"] },
+  ".jsx": { language: "javascript", categories: ["frontend"] },
+  ".yaml": {
+    language: "cloudformation",
+    categories: ["infrastructure", "architecture"]
+  },
+  ".yml": {
+    language: "cloudformation",
+    categories: ["infrastructure", "architecture"]
+  },
+  ".json": { language: "json", categories: ["configuration"] },
+  ".css": { language: "css", categories: ["frontend"] },
+  ".html": { language: "html", categories: ["frontend"] },
+  ".sql": { language: "sql", categories: ["data-access"] },
+  ".sh": { language: "shell", categories: ["infrastructure"] },
+  ".bash": { language: "shell", categories: ["infrastructure"] },
+  ".tf": { language: "terraform", categories: ["infrastructure"] },
+  ".md": { language: "markdown", categories: ["documentation"] }
 };
-function sha256(content) {
-  return createHash("sha256").update(content, "utf8").digest("hex");
-}
-function isValidName(name) {
-  return name.length <= 64 && NAME_RE.test(name);
-}
-function isValidPath(path) {
-  return path.length > 0 && path.length <= 512 && !path.startsWith("/") && path.split("/").every((s) => SEGMENT_RE.test(s) && s !== "." && s !== ".." && s !== PLUGIN_MANIFEST_FOLDER);
-}
-function frontmatterName(skillMd) {
-  const block = /^---\r?\n([\s\S]*?)\r?\n---/.exec(skillMd);
-  if (!block) return void 0;
-  const line = /^name:[ \t]*(.+?)[ \t]*$/m.exec(block[1]);
-  return line ? line[1].replace(/^(['"])(.*)\1$/, "$2") : void 0;
-}
-function defaultSkillDir(name) {
-  return join(homedir(), ".claude", "skills", name);
-}
-async function walk(root, { skipHidden }, dir = root, out = { files: [], links: [], hidden: [] }) {
-  for (const entry of await readdir(dir, { withFileTypes: true })) {
-    if (SKIPPED.has(entry.name) || entry.name.endsWith(".pyc")) continue;
-    const full = join(dir, entry.name);
-    const rel = relative(root, full).split(sep).join("/");
-    if (entry.isSymbolicLink()) out.links.push(rel);
-    else if (skipHidden && entry.name.startsWith(".")) out.hidden.push(rel);
-    else if (entry.isDirectory()) await walk(root, { skipHidden }, full, out);
-    else if (entry.isFile()) out.files.push(rel);
-  }
-  out.files.sort();
-  return out;
+var PATH_CATEGORY_RULES = [
+  { pattern: /backend\/functions\//, categories: ["api", "backend"] },
+  { pattern: /backend\/layers\//, categories: ["backend"] },
+  { pattern: /backend\//, categories: ["backend"] },
+  { pattern: /apps\/app\//, categories: ["frontend"] },
+  { pattern: /apps\/website\//, categories: ["frontend"] },
+  { pattern: /apps\/portal\//, categories: ["frontend"] },
+  { pattern: /packages\/ui\//, categories: ["frontend"] },
+  { pattern: /infra\//, categories: ["infrastructure"] },
+  { pattern: /\.github\//, categories: ["infrastructure"] },
+  { pattern: /tests?\//, categories: ["testing"] },
+  { pattern: /spec/, categories: ["testing"] },
+  { pattern: /docs\/adr/, categories: ["architecture"] },
+  { pattern: /template\.yaml$/, categories: ["infrastructure", "architecture"] }
+];
+function detectLanguage(filePath) {
+  const ext = filePath.slice(filePath.lastIndexOf("."));
+  return EXTENSION_MAP[ext];
 }
-async function readTextFiles(root, paths, what) {
-  if (paths.length > MAX_FILES) {
-    throw new Error(`${root} holds ${paths.length} files: ${what} holds at most ${MAX_FILES}`);
-  }
-  const decoder = new TextDecoder("utf-8", { fatal: true });
-  const files = [];
-  let total = 0;
-  for (const path of paths) {
-    if (!isValidPath(path)) {
-      throw new Error(`${path}: file names may use letters, digits, ".", "_" and "-" only`);
-    }
-    const raw = await readFile(join(root, ...path.split("/")));
-    if (raw.includes(0)) throw new Error(`${path} is binary: ${what} holds text files only`);
-    if (raw.length > MAX_FILE_BYTES) {
-      throw new Error(`${path} is ${raw.length} bytes: a file holds at most ${MAX_FILE_BYTES}`);
-    }
-    total += raw.length;
-    if (total > MAX_TOTAL_BYTES) {
-      throw new Error(`the files pass ${MAX_TOTAL_BYTES} bytes at ${path}`);
+function detectCategories(filePaths) {
+  const categories = /* @__PURE__ */ new Set();
+  for (const filePath of filePaths) {
+    const langInfo = detectLanguage(filePath);
+    if (langInfo) {
+      for (const cat of langInfo.categories) {
+        categories.add(cat);
+      }
     }
-    let content;
-    try {
-      content = decoder.decode(raw);
-    } catch {
-      throw new Error(`${path} is not UTF-8 text`);
+    for (const rule of PATH_CATEGORY_RULES) {
+      if (rule.pattern.test(filePath)) {
+        for (const cat of rule.categories) {
+          categories.add(cat);
+        }
+      }
     }
-    files.push({ path, content });
   }
-  return files;
+  return Array.from(categories);
 }
-async function readSkillDirectory(directory) {
-  const root = resolve(directory);
-  if (!existsSync(join(root, ENTRY_FILE))) {
-    throw new Error(`${root} has no ${ENTRY_FILE}: a skill folder holds SKILL.md at its root`);
-  }
-  const walked = await walk(root, { skipHidden: true });
-  if (walked.links.length) {
-    throw new Error(`${walked.links.join(", ")}: links are not followed; copy the file into the skill folder`);
+function detectLanguages(filePaths) {
+  const languages = /* @__PURE__ */ new Set();
+  for (const filePath of filePaths) {
+    const info = detectLanguage(filePath);
+    if (info) languages.add(info.language);
   }
-  const files = await readTextFiles(root, walked.files, "a skill");
-  const skillMd = files.find((f) => f.path === ENTRY_FILE);
-  const name = frontmatterName(skillMd.content);
-  if (!name) throw new Error(`${ENTRY_FILE} has no frontmatter name`);
-  return { name, files, skipped: walked.hidden };
+  return Array.from(languages);
 }
-function within(dest, path) {
-  if (!isValidPath(path)) throw new Error(`refusing to write ${JSON.stringify(path)}: not a skill path`);
-  const full = resolve(dest, ...path.split("/"));
-  if (!full.startsWith(resolve(dest) + sep)) throw new Error(`refusing to write outside ${dest}: ${path}`);
-  return full;
+
+// src/lib/deprecation.ts
+var LEGACY_TOOL_REMOVAL_EARLIEST = "2027-01-31";
+function legacyToolDescription(canonical, description) {
+  return `DEPRECATED \u2014 use \`${canonical}\` instead. This name still works and will not be removed before ${LEGACY_TOOL_REMOVAL_EARLIEST}. ${description}`;
 }
-async function readManifest(dest) {
+
+// src/lib/config-links.ts
+async function workspaceBase(apiClient) {
   try {
-    return JSON.parse(await readFile(join(dest, MANIFEST_FILE), "utf8"));
+    const access = await apiClient.get(
+      "/v1/docs/portal-access"
+    );
+    const slug = (access.host ?? "").split(".")[0];
+    return slug ? `https://${slug}.systemdox.com` : null;
   } catch {
-    return void 0;
+    return null;
   }
 }
-async function installSkill(version, dest, { overwrite = false } = {}) {
-  if (!isValidName(version.name)) throw new Error(`refusing to install ${JSON.stringify(version.name)}: not a skill name`);
-  const incoming = new Map(version.files.map((f) => [f.path, f]));
-  for (const f of version.files) within(dest, f.path);
-  if (existsSync(dest) && (await lstat(dest)).isSymbolicLink()) {
-    throw new Error(`${dest} is a link: install into a real folder`);
-  }
-  const walked = existsSync(dest) ? await walk(dest, { skipHidden: false }) : { files: [], links: [], hidden: [] };
-  if (walked.links.length) {
-    throw new Error(`${dest} holds links (${walked.links.join(", ")}): remove them, nothing was written`);
-  }
-  const present = walked.files;
-  const manifest = await readManifest(dest);
-  const known2 = Object.fromEntries(
-    Object.entries(manifest?.files ?? {}).filter(([p, h]) => isValidPath(p) && typeof h === "string")
-  );
-  const edited = [];
-  const untracked = [];
-  for (const path of present) {
-    const content = await readFile(join(dest, ...path.split("/")), "utf8");
-    if (Object.hasOwn(known2, path)) {
-      if (sha256(content) !== known2[path]) edited.push(path);
-    } else if (!incoming.has(path) || sha256(content) !== incoming.get(path).sha256) {
-      if (incoming.has(path) || !manifest) edited.push(path);
-      else untracked.push(path);
+function configLink(path, base) {
+  return base ? `${base}${path}` : `${path} in your SystemDox workspace`;
+}
+
+// src/tools/get-guardrails.ts
+var DESCRIPTION = "Retrieve SystemDox checks (banned patterns, required patterns, coding rules). Filter by language, category, or file path to get only relevant checks.";
+var inputSchema = () => ({
+  language: z.string().optional().describe(
+    "Filter by programming language (python, typescript, javascript, cloudformation)"
+  ),
+  category: z.string().optional().describe(
+    "Filter by category (imports, auth, error-handling, architecture, testing, security, conventions, data-access)"
+  ),
+  file_path: z.string().optional().describe(
+    "File path being edited \u2014 language is auto-detected from the extension"
+  )
+});
+function registerGetGuardrails(server, apiClient) {
+  const handler2 = async ({
+    language,
+    category,
+    file_path
+  }) => {
+    const guardrails = await apiClient.get("/v1/guardrails");
+    let filtered = guardrails;
+    const lang = language ?? (file_path ? detectLanguage(file_path)?.language : void 0);
+    if (lang) {
+      filtered = filtered.filter(
+        (g) => g.description.toLowerCase().includes(lang.toLowerCase()) || g.category.toLowerCase().includes(lang.toLowerCase()) || g.title.toLowerCase().includes(lang.toLowerCase())
+      );
     }
-  }
-  const blocking = edited.filter((p) => incoming.has(p) || !manifest);
-  if (blocking.length && !overwrite) throw new SkillInstallRefused(dest, blocking);
-  const written = [];
-  for (const f of version.files) {
-    const full = within(dest, f.path);
-    await mkdir(dirname(full), { recursive: true });
-    await writeFile(full, f.content, "utf8");
-    written.push(f.path);
-  }
-  const removed = [];
-  const keptEdited = [];
-  for (const path of Object.keys(known2)) {
-    if (incoming.has(path) || !present.includes(path)) continue;
-    if (edited.includes(path)) {
-      keptEdited.push(path);
-      continue;
+    if (category) {
+      filtered = filtered.filter(
+        (g) => g.category.toLowerCase() === category.toLowerCase()
+      );
     }
-    await rm(within(dest, path));
-    removed.push(path);
-  }
-  const next = {
-    name: version.name,
-    version: version.version,
-    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    files: Object.fromEntries(version.files.map((f) => [f.path, f.sha256]))
-  };
-  await writeFile(join(dest, MANIFEST_FILE), JSON.stringify(next, null, 2) + "\n", "utf8");
-  return {
-    dest,
-    version: version.version,
-    written,
-    removed,
-    keptUntracked: untracked.filter((p) => !incoming.has(p)),
-    keptEdited
+    if (filtered.length === 0) {
+      const text4 = guardrails.length === 0 ? `No checks found. Add checks at ${configLink("/docs/guardrails", await workspaceBase(apiClient))}` : `No checks found${lang ? ` for language "${lang}"` : ""}${category ? ` in category "${category}"` : ""}.`;
+      return {
+        content: [{ type: "text", text: text4 }]
+      };
+    }
+    const text3 = filtered.map(
+      (g) => `## ${g.title} [${g.severity}]
+
+${g.description}
+
+` + (g.pattern ? `**Bad pattern:**
+\`\`\`
+${g.pattern}
+\`\`\`
+
+` : "") + (g.fix ? `**Correct pattern:**
+\`\`\`
+${g.fix}
+\`\`\`
+
+` : "") + (g.fitnessTest ? `**Detection:** \`${g.fitnessTest}\`
+` : "")
+    ).join("\n---\n\n");
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Found ${filtered.length} check(s):
+
+${text3}`
+        }
+      ]
+    };
   };
-}
-function fenceFor(text3) {
-  const longest = Math.max(0, ...(text3.match(/`+/g) ?? []).map((r) => r.length));
-  return "`".repeat(Math.max(3, longest + 1));
-}
-function afterInstall(skillMd) {
-  return `No restart is needed: a running Claude Code session picks it up. If one does not list it yet, read ${skillMd} and follow it, or run /reload-skills.`;
-}
-function describeInstall(name, r) {
-  const lines = [
-    `Installed ${name} version ${r.version} into ${r.dest} (${r.written.length} file(s)).`
-  ];
-  if (r.removed.length) lines.push(`Removed (no longer in the skill): ${r.removed.join(", ")}`);
-  if (r.keptEdited.length) {
-    lines.push(`Kept, edited here and no longer in the skill: ${r.keptEdited.join(", ")}`);
-  }
-  if (r.keptUntracked.length) lines.push(`Kept, added here: ${r.keptUntracked.join(", ")}`);
-  lines.push(afterInstall(join(r.dest, "SKILL.md")));
-  return lines.join("\n");
+  server.registerTool(
+    "get_checks",
+    {
+      title: "Get Checks",
+      description: DESCRIPTION,
+      inputSchema: inputSchema()
+    },
+    handler2
+  );
+  server.registerTool(
+    "get_guardrails",
+    {
+      title: "Get Checks (legacy name)",
+      description: legacyToolDescription("get_checks", DESCRIPTION),
+      inputSchema: inputSchema()
+    },
+    handler2
+  );
 }
 
-// src/lib/team-setup-files.ts
-import { execFile } from "child_process";
-import { chmod, mkdir as mkdir2, readFile as readFile2, rename, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import { homedir as homedir2, userInfo } from "os";
-import { dirname as dirname2, join as join2 } from "path";
-import { promisify } from "util";
-var SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-function isWorkspace(value) {
-  return typeof value === "string" && value.length <= 64 && SLUG_RE.test(value);
+// src/tools/get-specs.ts
+import { z as z2 } from "zod";
+
+// src/lib/spec-label.ts
+var DECISION_PREFIX = "ADR: ";
+function isDecisionDraft(name) {
+  return name.startsWith(DECISION_PREFIX);
 }
-function homeDir() {
-  return homedir2();
+function specLabel(spec) {
+  return isDecisionDraft(spec.name) ? "decision record" : `${spec.requirementCount} requirements`;
 }
-function systemdoxDir() {
-  return join2(homeDir(), ".claude", "systemdox");
+
+// src/tools/get-specs.ts
+function registerGetSpecs(server, apiClient) {
+  server.registerTool(
+    "get_specs",
+    {
+      title: "Get Specs",
+      description: "Retrieve SystemDox specifications (proposal, requirements with RFC 2119 keywords, Given/When/Then scenarios). Get a specific spec by ID, filter by status, or search by keyword.",
+      inputSchema: {
+        draft_id: z2.string().optional().describe("Specific spec ID to retrieve with full content"),
+        status: z2.enum(["draft", "ready", "archived"]).optional().describe("Filter by status"),
+        search: z2.string().optional().describe("Keyword search across spec names")
+      }
+    },
+    async ({ draft_id, status, search }) => {
+      if (draft_id) {
+        const spec = await apiClient.get(
+          `/v1/specs/${encodeURIComponent(draft_id)}`
+        );
+        const sections = [`# ${spec.name}
+
+**Status:** ${spec.status}`];
+        if (spec.proposalContent) {
+          sections.push(`## Proposal
+
+${spec.proposalContent}`);
+        }
+        if (spec.requirements.length > 0) {
+          const reqs = spec.requirements.map((r) => `### ${r.name}
+
+${r.content}`).join("\n\n");
+          sections.push(`## Requirements
+
+${reqs}`);
+        }
+        if (spec.taskContent) {
+          sections.push(`## Tasks
+
+${spec.taskContent}`);
+        }
+        return {
+          content: [{ type: "text", text: sections.join("\n\n") }]
+        };
+      }
+      const specs = await apiClient.get("/v1/specs");
+      let filtered = specs;
+      if (status) {
+        filtered = filtered.filter((s) => s.status === status);
+      }
+      if (search) {
+        const term = search.toLowerCase();
+        filtered = filtered.filter(
+          (s) => s.name.toLowerCase().includes(term)
+        );
+      }
+      if (filtered.length === 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `No specs found${status ? ` with status "${status}"` : ""}${search ? ` matching "${search}"` : ""}.`
+            }
+          ]
+        };
+      }
+      const text3 = filtered.map(
+        (s) => `- **${s.name}** (${s.draftId}) \u2014 ${s.status}, ${specLabel(s)}` + (s.repoFullName ? `, repo: ${s.repoFullName}` : "")
+      ).join("\n");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Found ${filtered.length} spec(s):
+
+${text3}`
+          }
+        ]
+      };
+    }
+  );
 }
-function workspaceDir(workspace) {
-  if (!isWorkspace(workspace)) throw new Error(`${JSON.stringify(workspace)} is not a workspace name`);
-  return join2(systemdoxDir(), workspace);
+
+// src/tools/get-docs.ts
+import { z as z3 } from "zod";
+var PATH_FILTER_LIMIT = "1000";
+function literalPrefix(pattern) {
+  const wildcard = pattern.indexOf("*");
+  return wildcard < 0 ? pattern : pattern.slice(0, wildcard);
 }
-function statePath(workspace) {
-  return join2(workspaceDir(workspace), "state.json");
-}
-async function readJson(path, empty) {
-  let text3;
-  try {
-    text3 = await readFile2(path, "utf8");
-  } catch (e) {
-    if (e.code === "ENOENT") return empty;
-    throw e;
-  }
-  try {
-    return JSON.parse(text3);
-  } catch {
-    throw new Error(`${path} is not valid JSON: fix or remove it, then run this again`);
-  }
-}
-async function writeJsonAtomically(path, value, mode) {
-  await mkdir2(dirname2(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.tmp`;
-  await writeFile2(tmp, JSON.stringify(value, null, 2) + "\n", mode === void 0 ? "utf8" : { encoding: "utf8", mode });
-  await rename(tmp, path);
-}
-var run = promisify(execFile);
-async function readState(workspace) {
-  return readJson(statePath(workspace), {});
-}
-async function writeState(workspace, state) {
-  await writeJsonAtomically(statePath(workspace), state);
-}
-async function updateState(workspace, change) {
-  const state = await readState(workspace);
-  change(state);
-  await writeState(workspace, state);
-  return state;
-}
-
-// src/lib/session-brief.ts
-var INSTRUCTIONS_MAX = 2e3;
-var BRIEF_TIMEOUT_MS = 8e3;
-var SETUP_COMMAND = "npx -y @systemdox/mcp-server setup";
-var REFUSED = `SystemDox refused this computer's key, so the team's rules and skills cannot be read and every SystemDox tool fails. Tell the person once: a new key comes from the SystemDox console, Settings \u203A API keys, and \`${SETUP_COMMAND}\` in their own terminal stores it.`;
-var NOT_CHECKED = "SystemDox could not be read when this session started, so the team's skills were not checked. Call get_team_setup to check again before relying on them.";
-var CANNOT_SEE = "This server cannot see this computer's disk. For each skill listed under Team skills: if ~/.claude/skills/<name>/ is absent, or its .systemdox-skill.json names another version than get_team_setup lists, call install_skill with that version and write what it returns, unless the latest team plugin carries it. Leave a folder with no such file alone. If a file there differs from the hash that file holds for it, it was edited: ask the person before replacing it.";
-function noKey(reason) {
-  return `This computer has no SystemDox key it can use (${reason}), so the team's rules and skills cannot be read and every SystemDox tool fails. Tell the person once: \`${SETUP_COMMAND}\` in their own terminal asks for one.`;
-}
-function olderApi(setup) {
-  return `SystemDox workspace ${setup.workspace}. Before writing code in one of its repositories, call get_context with the task and the files you expect to touch, and obey what it returns. get_team_setup lists the team setup.`;
-}
-async function readJsonQuietly(path) {
-  try {
-    return JSON.parse(await readFile3(path, "utf8"));
-  } catch {
-    return void 0;
-  }
-}
-async function computerState(setup) {
-  const id = `${setup.workspace}-setup@systemdox-${setup.workspace}`;
-  const installed = await readJsonQuietly(join3(homeDir(), ".claude", "plugins", "installed_plugins.json"));
-  const entries2 = installed?.plugins?.[id];
-  const entry = Array.isArray(entries2) ? entries2.find((e) => (e?.scope ?? "user") === "user") : void 0;
-  const state = {
-    missing: [],
-    behind: [],
-    notFromSystemDox: [],
-    pluginInstalled: !!entry,
-    pluginVersion: entry?.version
-  };
-  const pluginCurrent = !!entry && !!setup.plugin && entry.version === `${setup.plugin.version}.0.0`;
-  for (const skill of setup.sessionBrief?.skills ?? []) {
-    const dir = defaultSkillDir(skill.name);
-    if (!existsSync2(dir)) {
-      if (!(pluginCurrent && setup.plugin?.skills?.[skill.name] !== void 0)) state.missing.push(skill.name);
-      continue;
-    }
-    const manifest = await readJsonQuietly(join3(dir, MANIFEST_FILE));
-    if (typeof manifest?.version !== "number" || !Number.isInteger(manifest.version)) {
-      state.notFromSystemDox.push(skill.name);
-    } else if (manifest.version !== skill.latestVersion) {
-      state.behind.push({ name: skill.name, here: manifest.version, latest: skill.latestVersion });
-    }
-  }
-  return state;
-}
-function hasPersonParts(setup) {
-  return Object.keys(setup.parts ?? {}).length > 0 || (setup.memory ?? []).length > 0 || (setup.sessionBrief?.heldSkills ?? []).some((h) => h.reason === "not-plain");
-}
-var MORE = (n) => `${n} more (get_team_setup lists them)`;
-var LIST_MIN = `all ${MORE(100)}`.length;
-function listWithin(items, room) {
-  const whole2 = items.join(", ");
-  if (whole2.length <= room) return whole2;
-  const kept = [];
-  let used = 0;
-  for (let i = 0; i < items.length; i++) {
-    const rest = items.length - i - 1;
-    const cost = items[i].length + (kept.length ? 2 : 0);
-    if (used + cost + ` and ${MORE(rest)}`.length > room) break;
-    kept.push(items[i]);
-    used += cost;
-  }
-  return kept.length ? `${kept.join(", ")} and ${MORE(items.length - kept.length)}` : `all ${MORE(items.length)}`;
-}
-function localSection(setup, state, room) {
-  const rest = hasPersonParts(setup) ? ` and that \`${SETUP_COMMAND}\` in their own terminal adds the rest of the team setup` : "";
-  const latest = new Map((setup.sessionBrief?.skills ?? []).map((s) => [s.name, s.latestVersion]));
-  const lines = [];
-  if (state.missing.length) {
-    lines.push({
-      head: "On this computer, missing: ",
-      items: state.missing.map((name) => `${name} version ${latest.get(name)}`),
-      tail: `. Install each now with install_skill at that version, before your first answer. Then tell the person what you installed${rest}. When a skill's line matches the request and it is not loaded yet, read ~/.claude/skills/<name>/SKILL.md and follow it.`
-    });
-  }
-  if (state.behind.length) {
-    lines.push({
-      head: "On this computer, behind: ",
-      items: state.behind.map((b) => `${b.name} (version ${b.here} here, latest ${b.latest})`),
-      tail: ". install_skill updates each to that latest version; if it refuses because files were edited, tell the person and leave them."
-    });
-  }
-  if (state.notFromSystemDox.length) {
-    lines.push({ head: "Not from SystemDox, left alone: ", items: state.notFromSystemDox, tail: "." });
-  }
-  const fixed = () => lines.reduce((n, l) => n + l.head.length + l.tail.length + LIST_MIN, 0) + Math.max(0, lines.length - 1);
-  while (lines.length && fixed() > room) lines.pop();
-  if (!lines.length) return "";
-  const share = Math.floor((room - fixed()) / lines.length) + LIST_MIN;
-  return lines.map((l) => `${l.head}${listWithin(l.items, share)}${l.tail}`).join("\n");
-}
-function fit(text3, section) {
-  const whole2 = section ? `${text3}
-
-${section}` : text3;
-  if (whole2.length <= INSTRUCTIONS_MAX) return whole2;
-  return text3.length <= INSTRUCTIONS_MAX ? text3 : `${text3.slice(0, INSTRUCTIONS_MAX - 1)}\u2026`;
-}
-async function readTeamSetup(apiClient, { keyProblem, timeoutMs = BRIEF_TIMEOUT_MS } = {}) {
-  if (keyProblem) return { problem: noKey(keyProblem) };
-  try {
-    const setup = await apiClient.getOwnTeamSetup(AbortSignal.timeout(timeoutMs));
-    return typeof setup?.workspace === "string" ? { setup } : { problem: NOT_CHECKED };
-  } catch (err) {
-    const status = err?.status;
-    return { problem: status === 401 || status === 403 ? REFUSED : NOT_CHECKED };
-  }
-}
-async function sessionInstructions(apiClient, options = {}) {
-  const read = await readTeamSetup(apiClient, options);
-  if ("problem" in read) return read.problem;
-  const text3 = read.setup.sessionBrief?.text ?? olderApi(read.setup);
-  try {
-    if (!options.localFiles) return fit(text3, read.setup.sessionBrief?.skills?.length ? CANNOT_SEE : "");
-    const room = INSTRUCTIONS_MAX - text3.length - 2;
-    return fit(text3, localSection(read.setup, await computerState(read.setup), room));
-  } catch {
-    return fit(text3, "");
-  }
-}
-
-// src/server.ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-
-// src/tools/get-guardrails.ts
-import { z } from "zod";
-
-// src/lib/language.ts
-var EXTENSION_MAP = {
-  ".py": { language: "python", categories: ["api", "backend", "data-access"] },
-  ".ts": { language: "typescript", categories: ["frontend", "api"] },
-  ".tsx": { language: "typescript", categories: ["frontend"] },
-  ".js": { language: "javascript", categories: ["frontend"] },
-  ".jsx": { language: "javascript", categories: ["frontend"] },
-  ".yaml": {
-    language: "cloudformation",
-    categories: ["infrastructure", "architecture"]
-  },
-  ".yml": {
-    language: "cloudformation",
-    categories: ["infrastructure", "architecture"]
-  },
-  ".json": { language: "json", categories: ["configuration"] },
-  ".css": { language: "css", categories: ["frontend"] },
-  ".html": { language: "html", categories: ["frontend"] },
-  ".sql": { language: "sql", categories: ["data-access"] },
-  ".sh": { language: "shell", categories: ["infrastructure"] },
-  ".bash": { language: "shell", categories: ["infrastructure"] },
-  ".tf": { language: "terraform", categories: ["infrastructure"] },
-  ".md": { language: "markdown", categories: ["documentation"] }
-};
-var PATH_CATEGORY_RULES = [
-  { pattern: /backend\/functions\//, categories: ["api", "backend"] },
-  { pattern: /backend\/layers\//, categories: ["backend"] },
-  { pattern: /backend\//, categories: ["backend"] },
-  { pattern: /apps\/app\//, categories: ["frontend"] },
-  { pattern: /apps\/website\//, categories: ["frontend"] },
-  { pattern: /apps\/portal\//, categories: ["frontend"] },
-  { pattern: /packages\/ui\//, categories: ["frontend"] },
-  { pattern: /infra\//, categories: ["infrastructure"] },
-  { pattern: /\.github\//, categories: ["infrastructure"] },
-  { pattern: /tests?\//, categories: ["testing"] },
-  { pattern: /spec/, categories: ["testing"] },
-  { pattern: /docs\/adr/, categories: ["architecture"] },
-  { pattern: /template\.yaml$/, categories: ["infrastructure", "architecture"] }
-];
-function detectLanguage(filePath) {
-  const ext = filePath.slice(filePath.lastIndexOf("."));
-  return EXTENSION_MAP[ext];
-}
-function detectCategories(filePaths) {
-  const categories = /* @__PURE__ */ new Set();
-  for (const filePath of filePaths) {
-    const langInfo = detectLanguage(filePath);
-    if (langInfo) {
-      for (const cat of langInfo.categories) {
-        categories.add(cat);
-      }
-    }
-    for (const rule of PATH_CATEGORY_RULES) {
-      if (rule.pattern.test(filePath)) {
-        for (const cat of rule.categories) {
-          categories.add(cat);
-        }
-      }
-    }
-  }
-  return Array.from(categories);
-}
-function detectLanguages(filePaths) {
-  const languages = /* @__PURE__ */ new Set();
-  for (const filePath of filePaths) {
-    const info = detectLanguage(filePath);
-    if (info) languages.add(info.language);
-  }
-  return Array.from(languages);
-}
-
-// src/lib/deprecation.ts
-var LEGACY_TOOL_REMOVAL_EARLIEST = "2027-01-31";
-function legacyToolDescription(canonical, description) {
-  return `DEPRECATED \u2014 use \`${canonical}\` instead. This name still works and will not be removed before ${LEGACY_TOOL_REMOVAL_EARLIEST}. ${description}`;
-}
-
-// src/lib/config-links.ts
-async function workspaceBase(apiClient) {
-  try {
-    const access = await apiClient.get(
-      "/v1/docs/portal-access"
-    );
-    const slug = (access.host ?? "").split(".")[0];
-    return slug ? `https://${slug}.systemdox.com` : null;
-  } catch {
-    return null;
-  }
-}
-function configLink(path, base) {
-  return base ? `${base}${path}` : `${path} in your SystemDox workspace`;
-}
-
-// src/tools/get-guardrails.ts
-var DESCRIPTION = "Retrieve SystemDox checks (banned patterns, required patterns, coding rules). Filter by language, category, or file path to get only relevant checks.";
-var inputSchema = () => ({
-  language: z.string().optional().describe(
-    "Filter by programming language (python, typescript, javascript, cloudformation)"
-  ),
-  category: z.string().optional().describe(
-    "Filter by category (imports, auth, error-handling, architecture, testing, security, conventions, data-access)"
-  ),
-  file_path: z.string().optional().describe(
-    "File path being edited \u2014 language is auto-detected from the extension"
-  )
-});
-function registerGetGuardrails(server, apiClient) {
-  const handler2 = async ({
-    language,
-    category,
-    file_path
-  }) => {
-    const guardrails = await apiClient.get("/v1/guardrails");
-    let filtered = guardrails;
-    const lang = language ?? (file_path ? detectLanguage(file_path)?.language : void 0);
-    if (lang) {
-      filtered = filtered.filter(
-        (g) => g.description.toLowerCase().includes(lang.toLowerCase()) || g.category.toLowerCase().includes(lang.toLowerCase()) || g.title.toLowerCase().includes(lang.toLowerCase())
-      );
-    }
-    if (category) {
-      filtered = filtered.filter(
-        (g) => g.category.toLowerCase() === category.toLowerCase()
-      );
-    }
-    if (filtered.length === 0) {
-      const text4 = guardrails.length === 0 ? `No checks found. Add checks at ${configLink("/docs/guardrails", await workspaceBase(apiClient))}` : `No checks found${lang ? ` for language "${lang}"` : ""}${category ? ` in category "${category}"` : ""}.`;
-      return {
-        content: [{ type: "text", text: text4 }]
-      };
-    }
-    const text3 = filtered.map(
-      (g) => `## ${g.title} [${g.severity}]
-
-${g.description}
-
-` + (g.pattern ? `**Bad pattern:**
-\`\`\`
-${g.pattern}
-\`\`\`
-
-` : "") + (g.fix ? `**Correct pattern:**
-\`\`\`
-${g.fix}
-\`\`\`
-
-` : "") + (g.fitnessTest ? `**Detection:** \`${g.fitnessTest}\`
-` : "")
-    ).join("\n---\n\n");
-    return {
-      content: [
-        {
-          type: "text",
-          text: `Found ${filtered.length} check(s):
-
-${text3}`
-        }
-      ]
-    };
-  };
-  server.registerTool(
-    "get_checks",
-    {
-      title: "Get Checks",
-      description: DESCRIPTION,
-      inputSchema: inputSchema()
-    },
-    handler2
-  );
-  server.registerTool(
-    "get_guardrails",
-    {
-      title: "Get Checks (legacy name)",
-      description: legacyToolDescription("get_checks", DESCRIPTION),
-      inputSchema: inputSchema()
-    },
-    handler2
-  );
-}
-
-// src/tools/get-specs.ts
-import { z as z2 } from "zod";
-
-// src/lib/spec-label.ts
-var DECISION_PREFIX = "ADR: ";
-function isDecisionDraft(name) {
-  return name.startsWith(DECISION_PREFIX);
-}
-function specLabel(spec) {
-  return isDecisionDraft(spec.name) ? "decision record" : `${spec.requirementCount} requirements`;
-}
-
-// src/tools/get-specs.ts
-function registerGetSpecs(server, apiClient) {
-  server.registerTool(
-    "get_specs",
-    {
-      title: "Get Specs",
-      description: "Retrieve SystemDox specifications (proposal, requirements with RFC 2119 keywords, Given/When/Then scenarios). Get a specific spec by ID, filter by status, or search by keyword.",
-      inputSchema: {
-        draft_id: z2.string().optional().describe("Specific spec ID to retrieve with full content"),
-        status: z2.enum(["draft", "ready", "archived"]).optional().describe("Filter by status"),
-        search: z2.string().optional().describe("Keyword search across spec names")
-      }
-    },
-    async ({ draft_id, status, search }) => {
-      if (draft_id) {
-        const spec = await apiClient.get(
-          `/v1/specs/${draft_id}`
-        );
-        const sections = [`# ${spec.name}
-
-**Status:** ${spec.status}`];
-        if (spec.proposalContent) {
-          sections.push(`## Proposal
-
-${spec.proposalContent}`);
-        }
-        if (spec.requirements.length > 0) {
-          const reqs = spec.requirements.map((r) => `### ${r.name}
-
-${r.content}`).join("\n\n");
-          sections.push(`## Requirements
-
-${reqs}`);
-        }
-        if (spec.taskContent) {
-          sections.push(`## Tasks
-
-${spec.taskContent}`);
-        }
-        return {
-          content: [{ type: "text", text: sections.join("\n\n") }]
-        };
-      }
-      const specs = await apiClient.get("/v1/specs");
-      let filtered = specs;
-      if (status) {
-        filtered = filtered.filter((s) => s.status === status);
-      }
-      if (search) {
-        const term = search.toLowerCase();
-        filtered = filtered.filter(
-          (s) => s.name.toLowerCase().includes(term)
-        );
-      }
-      if (filtered.length === 0) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: `No specs found${status ? ` with status "${status}"` : ""}${search ? ` matching "${search}"` : ""}.`
-            }
-          ]
-        };
-      }
-      const text3 = filtered.map(
-        (s) => `- **${s.name}** (${s.draftId}) \u2014 ${s.status}, ${specLabel(s)}` + (s.repoFullName ? `, repo: ${s.repoFullName}` : "")
-      ).join("\n");
-      return {
-        content: [
-          {
-            type: "text",
-            text: `Found ${filtered.length} spec(s):
-
-${text3}`
-          }
-        ]
-      };
-    }
-  );
-}
-
-// src/tools/get-docs.ts
-import { z as z3 } from "zod";
-var PATH_FILTER_LIMIT = "1000";
-function literalPrefix(pattern) {
-  const wildcard = pattern.indexOf("*");
-  return wildcard < 0 ? pattern : pattern.slice(0, wildcard);
-}
-function matchGlob(path, pattern) {
-  const regex = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\{\{GLOBSTAR\}\}/g, ".*");
-  return new RegExp(`^${regex}$`).test(path);
+function matchGlob(path, pattern) {
+  const regex = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\{\{GLOBSTAR\}\}/g, ".*");
+  return new RegExp(`^${regex}$`).test(path);
 }
 function registerGetDocs(server, apiClient) {
   server.registerTool(
@@ -1071,36 +677,299 @@ function registerGetTechStack(server, apiClient) {
       const stack = await apiClient.get(
         "/v1/ai/settings/stack"
       );
-      if (stack.length === 0) {
+      if (stack.length === 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `No tech stack entries configured. Add your stack at ${configLink("/docs/tech-stack", await workspaceBase(apiClient))}`
+            }
+          ]
+        };
+      }
+      const grouped = /* @__PURE__ */ new Map();
+      for (const entry of stack) {
+        const list = grouped.get(entry.category) ?? [];
+        list.push(entry);
+        grouped.set(entry.category, list);
+      }
+      const sections = Array.from(grouped.entries()).map(([category, entries2]) => {
+        const items = entries2.map(
+          (e) => `- ${e.name}${e.version ? ` v${e.version}` : ""}${e.notes ? ` \u2014 ${e.notes}` : ""}`
+        ).join("\n");
+        return `### ${category}
+${items}`;
+      }).join("\n\n");
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Tech stack (${stack.length} entries):
+
+${sections}`
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/get-planning-context.ts
+import { z as z4 } from "zod";
+function registerGetPlanningContext(server, apiClient) {
+  server.registerTool(
+    "get_planning_context",
+    {
+      title: "Get Planning Context",
+      description: "Retrieve org-wide planning context: connected repos with summaries, cross-repo dependencies, ADRs, and active specs. Optionally focus on a target repo.",
+      inputSchema: {
+        target_repo: z4.string().optional().describe(
+          "Focus on a specific repo (owner/repo format) to get its CLAUDE.md and relevant context"
+        )
+      }
+    },
+    async ({ target_repo }) => {
+      const params = {};
+      if (target_repo) params.targetRepo = target_repo;
+      const ctx = await apiClient.get(
+        "/v1/org/planning-context",
+        params
+      );
+      const sections = [];
+      if (ctx.repoSummaries.length > 0) {
+        const repos = ctx.repoSummaries.map(
+          (r) => `#### ${r.repo}
+${r.purpose}
+
+${r.summary}` + (r.conventions.length > 0 ? `
+
+**Conventions:**
+${r.conventions.map((c) => `- ${c}`).join("\n")}` : "")
+        ).join("\n\n");
+        sections.push(`## Repositories (${ctx.repoSummaries.length})
+
+${repos}`);
+      }
+      if (ctx.dependencies.length > 0) {
+        const deps = ctx.dependencies.map((d) => `- ${d.from} \u2192 ${d.to}${d.provenance === "inferred" ? " (inferred)" : ""}`).join("\n");
+        sections.push(`## Cross-Repo Dependencies
+
+${deps}`);
+      }
+      if (ctx.adrs.length > 0) {
+        const adrs = ctx.adrs.map((a) => `- ${a.title}${a.repo ? ` (${a.repo})` : ""}`).join("\n");
+        const total = ctx.adrTotal ?? ctx.adrs.length;
+        const count = total > ctx.adrs.length ? `${ctx.adrs.length} newest of ${total}` : `${ctx.adrs.length}`;
+        sections.push(`## Architecture Decision Records (${count})
+
+${adrs}`);
+      }
+      if (ctx.specs.length > 0) {
+        const specs = ctx.specs.map((s) => `- ${s.name} [${s.status}]`).join("\n");
+        sections.push(`## Specs (${ctx.specs.length})
+
+${specs}`);
+      }
+      if (sections.length === 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `No planning context available. Connect repositories at ${configLink("/settings/github", await workspaceBase(apiClient))}`
+            }
+          ]
+        };
+      }
+      return {
+        content: [
+          {
+            type: "text",
+            text: sections.join("\n\n")
+          }
+        ]
+      };
+    }
+  );
+}
+
+// src/tools/get-plan-board.ts
+import { z as z5 } from "zod";
+var API_ITEM_PAGE = 100;
+var DEFAULT_LIMIT = 50;
+var BUCKET_LABELS = {
+  inProgress: "In Progress",
+  todo: "Todo",
+  done: "Done"
+};
+var BUCKET_ORDER = ["inProgress", "todo", "done"];
+var STATUS_ARG_TO_BUCKET = {
+  todo: "todo",
+  in_progress: "inProgress",
+  done: "done"
+};
+function bucketOf(item) {
+  const status = (item.fields?.Status ?? "").trim().toLowerCase();
+  if (status) {
+    if (status.includes("done") || status.includes("ship") || status.includes("complete")) {
+      return "done";
+    }
+    if (status.includes("progress") || status.includes("doing") || status.includes("review")) {
+      return "inProgress";
+    }
+    return "todo";
+  }
+  return item.state === "CLOSED" ? "done" : "todo";
+}
+function formatBoards(boards) {
+  const lines = boards.map((b) => {
+    const c = b.statusCounts ?? { todo: 0, inProgress: 0, done: 0 };
+    return `- **${b.title}** \u2014 board #${b.number} \xB7 ${b.itemCount} item(s) (todo ${c.todo} \xB7 in progress ${c.inProgress} \xB7 done ${c.done})` + (b.description ? `
+  ${b.description}` : "") + `
+  ${b.url}`;
+  });
+  return lines.join("\n");
+}
+function formatItem(item) {
+  const meta = [];
+  if (item.labels.length > 0) meta.push(`labels: ${item.labels.join(", ")}`);
+  if (item.assignees.length > 0)
+    meta.push(`assignees: ${item.assignees.join(", ")}`);
+  const epic = item.fields?.Epic;
+  if (epic) meta.push(`epic: ${epic}`);
+  return `- #${item.number} ${item.title}${item.repo ? ` \u2014 ${item.repo}` : ""}` + (meta.length > 0 ? `
+  ${meta.join(" \xB7 ")}` : "") + (item.url ? `
+  ${item.url}` : "");
+}
+function registerGetPlanBoard(server, apiClient) {
+  server.registerTool(
+    "get_plan_board",
+    {
+      title: "Get Plan Board",
+      description: "Read the GitHub Projects boards connected to this workspace. With no arguments, lists the open boards with their item counts by status. With project_number, lists that board's issues grouped by status (In Progress / Todo / Done), each with issue number, title, repo, labels, assignees and URL \u2014 so you can see what is planned or in flight and pick up the right issue. Read-only: this tool cannot create, move, or close board items.",
+      inputSchema: {
+        project_number: z5.number().int().positive().optional().describe(
+          "Board number (the N in github.com/orgs/{org}/projects/N). Omit to list the open boards."
+        ),
+        status: z5.enum(["todo", "in_progress", "done"]).optional().describe(
+          "With project_number, return only the items in this status group"
+        ),
+        limit: z5.number().int().positive().max(200).optional().describe(
+          `Max items to list (default ${DEFAULT_LIMIT}). Group headings always show the true totals.`
+        )
+      }
+    },
+    async ({ project_number, status, limit }) => {
+      if (project_number === void 0) {
+        const boards = await apiClient.get(
+          "/v1/planning/projects"
+        );
+        if (boards.length === 0) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `No project boards found. Connect a GitHub organisation and create a board at ${configLink("/plan", await workspaceBase(apiClient))}`
+              }
+            ]
+          };
+        }
+        const open = boards.filter((b) => !b.closed);
+        if (open.length === 0) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `No open project boards (${boards.length} closed). Reopen one, or create a board at ${configLink("/plan", await workspaceBase(apiClient))}`
+              }
+            ]
+          };
+        }
+        const closedNote = boards.length > open.length ? `
+
+_${boards.length - open.length} closed board(s) not listed._` : "";
+        return {
+          content: [
+            {
+              type: "text",
+              text: `${open.length} open project board(s):
+
+${formatBoards(open)}` + closedNote + `
+
+Call get_plan_board with project_number to list a board's issues.`
+            }
+          ]
+        };
+      }
+      const response = await apiClient.get(
+        `/v1/planning/projects/${project_number}/items`
+      );
+      const allItems = response.items ?? [];
+      const boardName = response.projectTitle ? `**${response.projectTitle}** \u2014 board #${project_number}` : `Board #${project_number}`;
+      if (allItems.length === 0) {
         return {
           content: [
             {
               type: "text",
-              text: `No tech stack entries configured. Add your stack at ${configLink("/docs/tech-stack", await workspaceBase(apiClient))}`
+              text: `${boardName} has no issues, or it is not visible to this workspace's GitHub connection. Check the board at ${configLink("/plan", await workspaceBase(apiClient))}`
             }
           ]
         };
       }
-      const grouped = /* @__PURE__ */ new Map();
-      for (const entry of stack) {
-        const list = grouped.get(entry.category) ?? [];
-        list.push(entry);
-        grouped.set(entry.category, list);
+      const grouped = {
+        inProgress: [],
+        todo: [],
+        done: []
+      };
+      for (const item of allItems) grouped[bucketOf(item)].push(item);
+      const wanted = status ? [STATUS_ARG_TO_BUCKET[status]] : BUCKET_ORDER;
+      const shown = wanted.reduce((n, b) => n + grouped[b].length, 0);
+      if (shown === 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `${boardName}: no items with status "${status}" (of ${allItems.length} item(s) on the board).`
+            }
+          ]
+        };
+      }
+      const cap = limit ?? DEFAULT_LIMIT;
+      let budget = cap;
+      const sections = [];
+      let rendered = 0;
+      for (const b of wanted) {
+        const items = grouped[b];
+        if (items.length === 0) continue;
+        const slice = items.slice(0, Math.max(budget, 0));
+        budget -= slice.length;
+        rendered += slice.length;
+        const omitted = items.length - slice.length;
+        sections.push(
+          `### ${BUCKET_LABELS[b]} (${items.length})
+` + (slice.length > 0 ? slice.map(formatItem).join("\n") : "_(not listed \u2014 item limit reached)_") + (omitted > 0 && slice.length > 0 ? `
+_\u2026${omitted} more not listed._` : "")
+        );
+      }
+      const notes = [];
+      if (rendered < shown) {
+        notes.push(
+          `_Listing ${rendered} of ${shown} matching item(s) \u2014 raise limit (max 200) or filter by status to see the rest._`
+        );
+      }
+      if (allItems.length >= API_ITEM_PAGE) {
+        notes.push(
+          `_The API reads the board's first ${API_ITEM_PAGE} items; a larger board may have more._`
+        );
       }
-      const sections = Array.from(grouped.entries()).map(([category, entries2]) => {
-        const items = entries2.map(
-          (e) => `- ${e.name}${e.version ? ` v${e.version}` : ""}${e.notes ? ` \u2014 ${e.notes}` : ""}`
-        ).join("\n");
-        return `### ${category}
-${items}`;
-      }).join("\n\n");
       return {
         content: [
           {
             type: "text",
-            text: `Tech stack (${stack.length} entries):
+            text: `${boardName} \u2014 ${allItems.length} item(s)
 
-${sections}`
+` + sections.join("\n\n") + (notes.length > 0 ? `
+
+${notes.join("\n")}` : "")
           }
         ]
       };
@@ -1108,1083 +977,1204 @@ ${sections}`
   );
 }
 
-// src/tools/get-planning-context.ts
-import { z as z4 } from "zod";
-function registerGetPlanningContext(server, apiClient) {
-  server.registerTool(
-    "get_planning_context",
-    {
-      title: "Get Planning Context",
-      description: "Retrieve org-wide planning context: connected repos with summaries, cross-repo dependencies, ADRs, and active specs. Optionally focus on a target repo.",
-      inputSchema: {
-        target_repo: z4.string().optional().describe(
-          "Focus on a specific repo (owner/repo format) to get its CLAUDE.md and relevant context"
-        )
-      }
-    },
-    async ({ target_repo }) => {
-      const params = {};
-      if (target_repo) params.targetRepo = target_repo;
-      const ctx = await apiClient.get(
-        "/v1/org/planning-context",
-        params
-      );
-      const sections = [];
-      if (ctx.repoSummaries.length > 0) {
-        const repos = ctx.repoSummaries.map(
-          (r) => `#### ${r.repo}
-${r.purpose}
-
-${r.summary}` + (r.conventions.length > 0 ? `
-
-**Conventions:**
-${r.conventions.map((c) => `- ${c}`).join("\n")}` : "")
-        ).join("\n\n");
-        sections.push(`## Repositories (${ctx.repoSummaries.length})
+// src/tools/get-change.ts
+import { z as z6 } from "zod";
+var GITHUB_NAME = "[A-Za-z0-9][A-Za-z0-9._-]{0,99}";
+var REPO_RE = new RegExp(`^${GITHUB_NAME}/${GITHUB_NAME}$`);
+var SLUG_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var SLUG_MAX = 64;
+var PARTS = ["decision", "contract", "behaviour", "plan", "release"];
+var BRIEF = ["decision", "contract", "behaviour", "plan"];
+var PAST_REVIEW = /* @__PURE__ */ new Set(["passed", "being built", "done"]);
+function briefVerdict(states) {
+  const waiting = BRIEF.filter(
+    (part) => !(part === "decision" && states.decision === null) && !PAST_REVIEW.has(String(states[part]))
+  ).map((part) => `${part} is ${states[part] ?? "unknown"}`);
+  return waiting.length === 0 ? "The brief is passed" : `The brief is not passed: ${waiting.join(", ")}`;
+}
+function prLink(pr) {
+  return `[${pr.repo}#${pr.number}](${pr.url}) ${pr.state}`;
+}
+function fileSource(file) {
+  if (file.pullRequest) return prLink(file.pullRequest);
+  return file.direct ? "committed directly" : "\u2014";
+}
+function partPullRequests(change, part) {
+  const files = part === "contract" ? change.contract.files : part === "behaviour" ? change.behaviour.files : part === "plan" ? [change.plan.file] : [];
+  const prs = part === "decision" ? [change.decision?.pullRequest ?? null] : part === "release" ? change.release.prs : files.map((file) => file?.pullRequest ?? null);
+  const unique = /* @__PURE__ */ new Map();
+  for (const pr of prs) {
+    if (pr && !unique.has(`${pr.repo}#${pr.number}`)) unique.set(`${pr.repo}#${pr.number}`, pr);
+  }
+  return [...unique.values()].sort((a, b) => Number(b.state === "open") - Number(a.state === "open"));
+}
+function countsLine(counts) {
+  const tags = ["proposed", "built", "defect", "unbuilt", "open", "untagged"].filter((tag) => counts[tag] > 0).map((tag) => `${counts[tag]} ${tag}`);
+  return `${counts.total} scenario(s)` + (tags.length > 0 ? `: ${tags.join(", ")}` : "");
+}
+function partsTable(change) {
+  const rows = PARTS.filter((part) => !(part === "decision" && change.states.decision === null)).map((part) => {
+    const prs = partPullRequests(change, part);
+    return `| ${part} | ${change.states[part]} | ${prs.length > 0 ? prs.map(prLink).join(", ") : "\u2014"} |`;
+  });
+  return ["| Part | State | Pull request |", "|---|---|---|", ...rows].join("\n");
+}
+function decisionSection(change) {
+  const decision = change.decision;
+  if (decision === null) return "## Decision\n\nNone: the proposal names no ADR (a small change).";
+  const status = decision.status || "no record in a connected repository";
+  return `## Decision
 
-${repos}`);
-      }
-      if (ctx.dependencies.length > 0) {
-        const deps = ctx.dependencies.map((d) => `- ${d.from} \u2192 ${d.to}${d.provenance === "inferred" ? " (inferred)" : ""}`).join("\n");
-        sections.push(`## Cross-Repo Dependencies
+${decision.adr} \xB7 ${status}${decision.title ? ` \u2014 ${decision.title}` : ""}`;
+}
+function contractSection(change) {
+  const files = change.contract.files;
+  return "## Contract\n\n" + (files.length > 0 ? files.map((file) => `- ${file.path} \u2014 ${fileSource(file)}`).join("\n") : "No contract file yet (openapi.yaml, asyncapi.yaml or contract.md).");
+}
+function behaviourSection(change) {
+  const { files, counts } = change.behaviour;
+  if (files.length === 0) {
+    return `## Behaviour
 
-${deps}`);
-      }
-      if (ctx.adrs.length > 0) {
-        const adrs = ctx.adrs.map((a) => `- ${a.title}${a.repo ? ` (${a.repo})` : ""}`).join("\n");
-        const total = ctx.adrTotal ?? ctx.adrs.length;
-        const count = total > ctx.adrs.length ? `${ctx.adrs.length} newest of ${total}` : `${ctx.adrs.length}`;
-        sections.push(`## Architecture Decision Records (${count})
+No feature file names this change. A feature file joins it when its path or its first ten lines name \`${change.slug}\`${change.decision ? ` or ${change.decision.adr}` : ""}.`;
+  }
+  const blocks = files.map(
+    (file) => [
+      `### ${file.path}`,
+      "",
+      [file.title, file.runner ? `runner ${file.runner}` : "", fileSource(file), countsLine(file.counts)].filter(Boolean).join(" \xB7 "),
+      "",
+      ...file.scenarios.map((s) => `- ${s.id || "(no id)"} \xB7 ${s.state || "untagged"} \xB7 ${s.title}`)
+    ].join("\n")
+  );
+  return ["## Behaviour", countsLine(counts), ...blocks].join("\n\n");
+}
+function planSection(change) {
+  const { file, draftId, board } = change.plan;
+  const boardLine = board ? `[#${board.number} ${board.title}](${board.url}) \u2014 todo ${board.items.todo} \xB7 in progress ${board.items.inProgress} \xB7 done ${board.items.done}` + (board.items.truncated ? " (counted over its first 500 items)" : "") : "none";
+  return [
+    "## Plan",
+    "",
+    `- plan.md: ${file ? `${file.path} \u2014 ${fileSource(file)}` : "none"}`,
+    `- Draft: ${draftId ?? "none"}`,
+    `- Board: ${boardLine}`
+  ].join("\n");
+}
+function releaseSection(change) {
+  const lines = change.release.prs.map(
+    (pr) => `- ${prLink(pr)} \xB7 ${pr.title} \xB7 ` + (pr.approvingReview ? `approved by ${pr.approvingReview.by} at ${pr.approvingReview.at}` : "no approving review on its head yet")
+  );
+  return `## Release
 
-${adrs}`);
-      }
-      if (ctx.specs.length > 0) {
-        const specs = ctx.specs.map((s) => `- ${s.name} [${s.status}]`).join("\n");
-        sections.push(`## Specs (${ctx.specs.length})
+${lines.length > 0 ? lines.join("\n") : "No release pull request is open."}`;
+}
+function formatChange(change) {
+  const header = `# ${change.title}
 
-${specs}`);
-      }
-      if (sections.length === 0) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: `No planning context available. Connect repositories at ${configLink("/settings/github", await workspaceBase(apiClient))}`
-            }
-          ]
-        };
+\`${change.key}\` \xB7 size: ${change.size}` + (change.archived ? " \xB7 archived: read-only, done" : "") + ` \xB7 synced ${change.syncedAt}`;
+  return [
+    header,
+    partsTable(change),
+    decisionSection(change),
+    contractSection(change),
+    behaviourSection(change),
+    planSection(change),
+    releaseSection(change),
+    // Compact: a change's every scenario with its steps rides in this block.
+    "```json\n" + JSON.stringify(change) + "\n```",
+    briefVerdict(change.states)
+  ].join("\n\n");
+}
+function registerGetChange(server, apiClient) {
+  server.registerTool(
+    "get_change",
+    {
+      title: "Get Change",
+      description: `Read one change (a specs/changes/<slug>/ folder of a connected repository) as SystemDox last synced it from GitHub: the state of each part of its brief (decision, contract, behaviour, plan) and of its release, each with its pull request; the decision's ADR and status; the contract files; every feature file that names the change, with its scenarios as id \xB7 state \xB7 title; the plan (plan.md, the draft, the board); the release pull requests; and the Change object as JSON. The last line says "The brief is passed" or "The brief is not passed: <part> is <state>". Call it before building a story, and stop if the brief is not passed or the story's scenarios are not proposed. Read-only.`,
+      inputSchema: {
+        repo: z6.string().regex(REPO_RE, "the repository as owner/name, e.g. acme/booking-api").describe("The repository that holds the change, as owner/name"),
+        slug: z6.string().max(SLUG_MAX).regex(SLUG_RE, "a change folder's name: lower-case words joined by -, e.g. customer-reminders").describe("The change's folder name: specs/changes/<slug>/")
+      },
+      annotations: { readOnlyHint: true }
+    },
+    async ({ repo, slug }) => {
+      const [owner, name] = repo.split("/");
+      let change;
+      try {
+        change = await apiClient.getFresh(
+          `/v1/changes/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/${encodeURIComponent(slug)}`
+        );
+      } catch (err) {
+        if (err.status === 404) {
+          return {
+            content: [{ type: "text", text: `No such change ${repo}/${slug}` }],
+            isError: true
+          };
+        }
+        throw err;
       }
-      return {
-        content: [
-          {
-            type: "text",
-            text: sections.join("\n\n")
-          }
-        ]
-      };
+      return { content: [{ type: "text", text: formatChange(change) }] };
     }
   );
 }
 
-// src/tools/get-plan-board.ts
-import { z as z5 } from "zod";
-var API_ITEM_PAGE = 100;
-var DEFAULT_LIMIT = 50;
-var BUCKET_LABELS = {
-  inProgress: "In Progress",
-  todo: "Todo",
-  done: "Done"
-};
-var BUCKET_ORDER = ["inProgress", "todo", "done"];
-var STATUS_ARG_TO_BUCKET = {
-  todo: "todo",
-  in_progress: "inProgress",
-  done: "done"
+// src/tools/get-context.ts
+import { z as z7 } from "zod";
+
+// src/lib/scoring.ts
+var WEIGHT_PATH = 0.4;
+var WEIGHT_KEYWORD = 0.3;
+var WEIGHT_RECENCY = 0.15;
+var WEIGHT_SEVERITY = 0.15;
+var SEVERITY_SCORES = {
+  critical: 1,
+  high: 0.75,
+  medium: 0.5,
+  low: 0.25
 };
-function bucketOf(item) {
-  const status = (item.fields?.Status ?? "").trim().toLowerCase();
-  if (status) {
-    if (status.includes("done") || status.includes("ship") || status.includes("complete")) {
-      return "done";
-    }
-    if (status.includes("progress") || status.includes("doing") || status.includes("review")) {
-      return "inProgress";
-    }
-    return "todo";
+var MIN_TITLE_SHARE = 1 / 3;
+var RECORD_PATH = /(^|\/)changelog\//;
+var RECORD_FACTOR = 0.5;
+var CHARS_PER_TOKEN = 4;
+function estimateTokens(text3) {
+  return Math.ceil(text3.length / CHARS_PER_TOKEN);
+}
+function truncateToTokens(text3, maxTokens) {
+  const maxChars = Math.max(0, maxTokens) * CHARS_PER_TOKEN;
+  if (text3.length <= maxChars) return { text: text3, truncated: false };
+  const head = text3.slice(0, maxChars);
+  const floor = Math.floor(maxChars * 0.75);
+  const paragraph = head.lastIndexOf("\n\n");
+  const line = head.lastIndexOf("\n");
+  let cut = maxChars;
+  if (paragraph >= floor) cut = paragraph;
+  else if (line >= floor) cut = line;
+  return { text: head.slice(0, cut).trimEnd(), truncated: true };
+}
+function scorePathMatch(item, languages, categories) {
+  if (languages.length === 0 && categories.length === 0) return 0.5;
+  let score = 0;
+  const itemLang = item.language?.toLowerCase() ?? "";
+  const itemCat = item.category?.toLowerCase() ?? "";
+  if (itemLang && languages.some((l) => itemLang.includes(l))) {
+    score += 0.6;
   }
-  return item.state === "CLOSED" ? "done" : "todo";
+  if (itemCat && categories.some((c) => itemCat.includes(c))) {
+    score += 0.4;
+  }
+  return Math.min(score, 1);
 }
-function formatBoards(boards) {
-  const lines = boards.map((b) => {
-    const c = b.statusCounts ?? { todo: 0, inProgress: 0, done: 0 };
-    return `- **${b.title}** \u2014 board #${b.number} \xB7 ${b.itemCount} item(s) (todo ${c.todo} \xB7 in progress ${c.inProgress} \xB7 done ${c.done})` + (b.description ? `
-  ${b.description}` : "") + `
-  ${b.url}`;
-  });
-  return lines.join("\n");
+function scoreKeywordMatch(item, keywords) {
+  if (keywords.length === 0) return 0;
+  const searchable = `${item.title} ${item.content}`.toLowerCase();
+  let matches = 0;
+  for (const kw of keywords) {
+    if (searchable.includes(kw)) matches++;
+  }
+  return Math.min(matches / keywords.length, 1);
+}
+function scoreRecency(item) {
+  if (!item.updatedAt) return 0.5;
+  const now = Date.now();
+  const updated = new Date(item.updatedAt).getTime();
+  const daysSince = (now - updated) / (1e3 * 60 * 60 * 24);
+  if (daysSince <= 7) return 1;
+  if (daysSince <= 30) return 0.75;
+  if (daysSince <= 90) return 0.5;
+  return 0.25;
+}
+function scoreSeverity(item) {
+  if (!item.severity) return 0.5;
+  return SEVERITY_SCORES[item.severity] ?? 0.5;
+}
+function stem(word) {
+  return word.length > 3 ? word.replace(/s$/, "") : word;
+}
+function stems(text3) {
+  return new Set(
+    text3.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean).map(stem)
+  );
+}
+function titleShare(title, keywords) {
+  const wanted = stems(keywords.join(" "));
+  if (wanted.size === 0) return 0;
+  const held = stems(title);
+  let matches = 0;
+  for (const word of wanted) {
+    if (held.has(word)) matches++;
+  }
+  return matches / wanted.size;
+}
+function scoreReference(item, keywords) {
+  const share = titleShare(item.title, keywords);
+  const score = Math.max(
+    item.relevance ?? 0,
+    share >= MIN_TITLE_SHARE ? share : 0
+  );
+  return RECORD_PATH.test(item.path ?? "") ? score * RECORD_FACTOR : score;
+}
+function extractKeywords(text3) {
+  const stopWords = /* @__PURE__ */ new Set([
+    "the",
+    "a",
+    "an",
+    "is",
+    "are",
+    "was",
+    "were",
+    "be",
+    "been",
+    "being",
+    "have",
+    "has",
+    "had",
+    "do",
+    "does",
+    "did",
+    "will",
+    "would",
+    "could",
+    "should",
+    "may",
+    "might",
+    "can",
+    "shall",
+    "to",
+    "of",
+    "in",
+    "for",
+    "on",
+    "with",
+    "at",
+    "by",
+    "from",
+    "as",
+    "into",
+    "about",
+    "between",
+    "through",
+    "after",
+    "before",
+    "during",
+    "without",
+    "this",
+    "that",
+    "these",
+    "those",
+    "it",
+    "its",
+    "and",
+    "or",
+    "but",
+    "not",
+    "no",
+    "all",
+    "each",
+    "every",
+    "both",
+    "few",
+    "more",
+    "most",
+    "other",
+    "some",
+    "such",
+    "than",
+    "too",
+    "very",
+    "just",
+    "also",
+    "only",
+    "new",
+    "add",
+    "update",
+    "fix",
+    "change",
+    "make",
+    "use",
+    "get",
+    "set",
+    "need",
+    "want",
+    "implement",
+    "create"
+  ]);
+  return text3.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !stopWords.has(w));
+}
+function scoreItems(items, taskDescription, filePaths) {
+  const languages = detectLanguages(filePaths);
+  const categories = detectCategories(filePaths);
+  const keywords = extractKeywords(taskDescription);
+  return items.map((item) => {
+    const pathScore = scorePathMatch(item, languages, categories);
+    const keywordScore = scoreKeywordMatch(item, keywords);
+    const recencyScore = scoreRecency(item);
+    const severityScore = scoreSeverity(item);
+    const isReference = item.type === "spec" || item.type === "doc";
+    const score = isReference && keywords.length > 0 ? scoreReference(item, keywords) : pathScore * WEIGHT_PATH + keywordScore * WEIGHT_KEYWORD + recencyScore * WEIGHT_RECENCY + severityScore * WEIGHT_SEVERITY;
+    return {
+      type: item.type,
+      id: item.id,
+      title: item.title,
+      content: item.content,
+      score,
+      tokenEstimate: estimateTokens(item.content)
+    };
+  }).filter((item) => item.score > 0).sort((a, b) => b.score - a.score);
 }
-function formatItem(item) {
-  const meta = [];
-  if (item.labels.length > 0) meta.push(`labels: ${item.labels.join(", ")}`);
-  if (item.assignees.length > 0)
-    meta.push(`assignees: ${item.assignees.join(", ")}`);
-  const epic = item.fields?.Epic;
-  if (epic) meta.push(`epic: ${epic}`);
-  return `- #${item.number} ${item.title}${item.repo ? ` \u2014 ${item.repo}` : ""}` + (meta.length > 0 ? `
-  ${meta.join(" \xB7 ")}` : "") + (item.url ? `
-  ${item.url}` : "");
+function selectWithinBudget(items, maxTokens) {
+  const selected = [];
+  let tokensUsed = 0;
+  for (const item of items) {
+    if (tokensUsed + item.tokenEstimate > maxTokens) continue;
+    selected.push(item);
+    tokensUsed += item.tokenEstimate;
+  }
+  return { selected, tokensUsed, totalItems: items.length };
 }
-function registerGetPlanBoard(server, apiClient) {
-  server.registerTool(
-    "get_plan_board",
-    {
-      title: "Get Plan Board",
-      description: "Read the GitHub Projects boards connected to this workspace. With no arguments, lists the open boards with their item counts by status. With project_number, lists that board's issues grouped by status (In Progress / Todo / Done), each with issue number, title, repo, labels, assignees and URL \u2014 so you can see what is planned or in flight and pick up the right issue. Read-only: this tool cannot create, move, or close board items.",
-      inputSchema: {
-        project_number: z5.number().int().positive().optional().describe(
-          "Board number (the N in github.com/orgs/{org}/projects/N). Omit to list the open boards."
-        ),
-        status: z5.enum(["todo", "in_progress", "done"]).optional().describe(
-          "With project_number, return only the items in this status group"
-        ),
-        limit: z5.number().int().positive().max(200).optional().describe(
-          `Max items to list (default ${DEFAULT_LIMIT}). Group headings always show the true totals.`
-        )
-      }
-    },
-    async ({ project_number, status, limit }) => {
-      if (project_number === void 0) {
-        const boards = await apiClient.get(
-          "/v1/planning/projects"
-        );
-        if (boards.length === 0) {
-          return {
-            content: [
-              {
-                type: "text",
-                text: `No project boards found. Connect a GitHub organisation and create a board at ${configLink("/plan", await workspaceBase(apiClient))}`
-              }
-            ]
-          };
-        }
-        const open = boards.filter((b) => !b.closed);
-        if (open.length === 0) {
-          return {
-            content: [
-              {
-                type: "text",
-                text: `No open project boards (${boards.length} closed). Reopen one, or create a board at ${configLink("/plan", await workspaceBase(apiClient))}`
-              }
-            ]
-          };
-        }
-        const closedNote = boards.length > open.length ? `
-
-_${boards.length - open.length} closed board(s) not listed._` : "";
-        return {
-          content: [
-            {
-              type: "text",
-              text: `${open.length} open project board(s):
 
-${formatBoards(open)}` + closedNote + `
+// src/lib/context-builder.ts
+var DEFAULT_BUDGET = 4e3;
+var RESERVE_TOKENS = 200;
+var GUARDRAIL_SHARE = 0.35;
+var MIN_BODY_TOKENS = 150;
+var MAX_HYDRATED = 8;
+var MAX_TAIL = 10;
+var TAIL_SHARE = 0.15;
+var TRUNCATION_NOTICE_TOKENS = 30;
+var STACK_SHARE = 0.1;
+var MIN_REFERENCES = 3;
+var SEARCH_RESULTS = 30;
+var MAX_QUERY_CHARS = 300;
+function formatGuardrail(g) {
+  let text3 = `## ${g.title} [${g.severity}]
 
-Call get_plan_board with project_number to list a board's issues.`
-            }
-          ]
-        };
-      }
-      const response = await apiClient.get(
-        `/v1/planning/projects/${project_number}/items`
-      );
-      const allItems = response.items ?? [];
-      const boardName = response.projectTitle ? `**${response.projectTitle}** \u2014 board #${project_number}` : `Board #${project_number}`;
-      if (allItems.length === 0) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: `${boardName} has no issues, or it is not visible to this workspace's GitHub connection. Check the board at ${configLink("/plan", await workspaceBase(apiClient))}`
-            }
-          ]
-        };
-      }
-      const grouped = {
-        inProgress: [],
-        todo: [],
-        done: []
-      };
-      for (const item of allItems) grouped[bucketOf(item)].push(item);
-      const wanted = status ? [STATUS_ARG_TO_BUCKET[status]] : BUCKET_ORDER;
-      const shown = wanted.reduce((n, b) => n + grouped[b].length, 0);
-      if (shown === 0) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: `${boardName}: no items with status "${status}" (of ${allItems.length} item(s) on the board).`
-            }
-          ]
-        };
-      }
-      const cap = limit ?? DEFAULT_LIMIT;
-      let budget = cap;
-      const sections = [];
-      let rendered = 0;
-      for (const b of wanted) {
-        const items = grouped[b];
-        if (items.length === 0) continue;
-        const slice = items.slice(0, Math.max(budget, 0));
-        budget -= slice.length;
-        rendered += slice.length;
-        const omitted = items.length - slice.length;
-        sections.push(
-          `### ${BUCKET_LABELS[b]} (${items.length})
-` + (slice.length > 0 ? slice.map(formatItem).join("\n") : "_(not listed \u2014 item limit reached)_") + (omitted > 0 && slice.length > 0 ? `
-_\u2026${omitted} more not listed._` : "")
-        );
-      }
-      const notes = [];
-      if (rendered < shown) {
-        notes.push(
-          `_Listing ${rendered} of ${shown} matching item(s) \u2014 raise limit (max 200) or filter by status to see the rest._`
-        );
-      }
-      if (allItems.length >= API_ITEM_PAGE) {
-        notes.push(
-          `_The API reads the board's first ${API_ITEM_PAGE} items; a larger board may have more._`
-        );
-      }
-      return {
-        content: [
-          {
-            type: "text",
-            text: `${boardName} \u2014 ${allItems.length} item(s)
+${g.description}`;
+  if (g.pattern) text3 += `
 
-` + sections.join("\n\n") + (notes.length > 0 ? `
+**Bad:** \`\`\`
+${g.pattern}
+\`\`\``;
+  if (g.fix) text3 += `
 
-${notes.join("\n")}` : "")
-          }
-        ]
-      };
-    }
-  );
+**Good:** \`\`\`
+${g.fix}
+\`\`\``;
+  return text3;
 }
-
-// src/tools/get-change.ts
-import { z as z6 } from "zod";
-var GITHUB_NAME = "[A-Za-z0-9][A-Za-z0-9._-]{0,99}";
-var REPO_RE = new RegExp(`^${GITHUB_NAME}/${GITHUB_NAME}$`);
-var SLUG_RE2 = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-var SLUG_MAX = 64;
-var PARTS = ["decision", "contract", "behaviour", "plan", "release"];
-var BRIEF = ["decision", "contract", "behaviour", "plan"];
-var PAST_REVIEW = /* @__PURE__ */ new Set(["passed", "being built", "done"]);
-function briefVerdict(states) {
-  const waiting = BRIEF.filter(
-    (part) => !(part === "decision" && states.decision === null) && !PAST_REVIEW.has(String(states[part]))
-  ).map((part) => `${part} is ${states[part] ?? "unknown"}`);
-  return waiting.length === 0 ? "The brief is passed" : `The brief is not passed: ${waiting.join(", ")}`;
+function formatSpecHeadline(s) {
+  return `### ${s.name}
+\`draft_id: ${s.draftId}\` \xB7 ${s.status} \xB7 ${specLabel(s)}`;
 }
-function prLink(pr) {
-  return `[${pr.repo}#${pr.number}](${pr.url}) ${pr.state}`;
+function formatDocHeadline(d) {
+  return `### ${d.title}
+\`doc_id: ${d.id}\` \xB7 \`${d.repo_full_name}/${d.path}\` \xB7 ${d.doc_type}`;
 }
-function fileSource(file) {
-  if (file.pullRequest) return prLink(file.pullRequest);
-  return file.direct ? "committed directly" : "\u2014";
+function formatStack(entries2) {
+  return entries2.map(
+    (e) => `- ${e.name}${e.version ? ` v${e.version}` : ""}${e.notes ? ` \u2014 ${e.notes}` : ""}`
+  ).join("\n");
 }
-function partPullRequests(change, part) {
-  const files = part === "contract" ? change.contract.files : part === "behaviour" ? change.behaviour.files : part === "plan" ? [change.plan.file] : [];
-  const prs = part === "decision" ? [change.decision?.pullRequest ?? null] : part === "release" ? change.release.prs : files.map((file) => file?.pullRequest ?? null);
-  const unique = /* @__PURE__ */ new Map();
-  for (const pr of prs) {
-    if (pr && !unique.has(`${pr.repo}#${pr.number}`)) unique.set(`${pr.repo}#${pr.number}`, pr);
+function selectStack(entries2, words, maxTokens) {
+  const named = (e) => {
+    const entry = `${e.name} ${e.notes ?? ""}`.toLowerCase();
+    return words.some((w) => entry.includes(w));
+  };
+  const ordered = [...entries2.filter(named), ...entries2.filter((e) => !named(e))];
+  const shown = [];
+  for (const entry of ordered) {
+    if (shown.length > 0 && estimateTokens(formatStack([...shown, entry])) > maxTokens) {
+      break;
+    }
+    shown.push(entry);
   }
-  return [...unique.values()].sort((a, b) => Number(b.state === "open") - Number(a.state === "open"));
-}
-function countsLine(counts) {
-  const tags = ["proposed", "built", "defect", "unbuilt", "open", "untagged"].filter((tag) => counts[tag] > 0).map((tag) => `${counts[tag]} ${tag}`);
-  return `${counts.total} scenario(s)` + (tags.length > 0 ? `: ${tags.join(", ")}` : "");
-}
-function partsTable(change) {
-  const rows = PARTS.filter((part) => !(part === "decision" && change.states.decision === null)).map((part) => {
-    const prs = partPullRequests(change, part);
-    return `| ${part} | ${change.states[part]} | ${prs.length > 0 ? prs.map(prLink).join(", ") : "\u2014"} |`;
-  });
-  return ["| Part | State | Pull request |", "|---|---|---|", ...rows].join("\n");
+  return { text: formatStack(shown), hidden: entries2.length - shown.length };
 }
-function decisionSection(change) {
-  const decision = change.decision;
-  if (decision === null) return "## Decision\n\nNone: the proposal names no ADR (a small change).";
-  const status = decision.status || "no record in a connected repository";
-  return `## Decision
+function formatRules(rules) {
+  const byCategory = /* @__PURE__ */ new Map();
+  for (const r of rules) {
+    const cat = r.category || "other";
+    if (!byCategory.has(cat)) byCategory.set(cat, []);
+    byCategory.get(cat).push(r);
+  }
+  let text3 = "";
+  for (const [cat, catRules] of byCategory) {
+    text3 += `### ${cat.charAt(0).toUpperCase() + cat.slice(1)}
+`;
+    for (const r of catRules) {
+      text3 += `- ${r.text}
+`;
+    }
+    text3 += "\n";
+  }
+  return `## Project Rules (${rules.length})
 
-${decision.adr} \xB7 ${status}${decision.title ? ` \u2014 ${decision.title}` : ""}`;
+${text3.trim()}`;
 }
-function contractSection(change) {
-  const files = change.contract.files;
-  return "## Contract\n\n" + (files.length > 0 ? files.map((file) => `- ${file.path} \u2014 ${fileSource(file)}`).join("\n") : "No contract file yet (openapi.yaml, asyncapi.yaml or contract.md).");
+async function findDocs(api, taskDescription) {
+  const query = taskDescription.trim().slice(0, MAX_QUERY_CHARS);
+  if (query) {
+    try {
+      const found = await api.get("/v1/docs", {
+        q: query,
+        limit: String(SEARCH_RESULTS)
+      });
+      if (found.items.length > 0) return { ...found, searched: true };
+    } catch {
+    }
+  }
+  const listed = await api.get("/v1/docs");
+  return { ...listed, searched: false };
 }
-function behaviourSection(change) {
-  const { files, counts } = change.behaviour;
-  if (files.length === 0) {
-    return `## Behaviour
+async function fetchSpecBody(api, draftId) {
+  const spec = await api.get(
+    `/v1/specs/${encodeURIComponent(draftId)}`
+  );
+  const parts = [];
+  if (spec.proposalContent) {
+    parts.push(`**Proposal**
 
-No feature file names this change. A feature file joins it when its path or its first ten lines name \`${change.slug}\`${change.decision ? ` or ${change.decision.adr}` : ""}.`;
+${spec.proposalContent}`);
   }
-  const blocks = files.map(
-    (file) => [
-      `### ${file.path}`,
-      "",
-      [file.title, file.runner ? `runner ${file.runner}` : "", fileSource(file), countsLine(file.counts)].filter(Boolean).join(" \xB7 "),
-      "",
-      ...file.scenarios.map((s) => `- ${s.id || "(no id)"} \xB7 ${s.state || "untagged"} \xB7 ${s.title}`)
-    ].join("\n")
-  );
-  return ["## Behaviour", countsLine(counts), ...blocks].join("\n\n");
-}
-function planSection(change) {
-  const { file, draftId, board } = change.plan;
-  const boardLine = board ? `[#${board.number} ${board.title}](${board.url}) \u2014 todo ${board.items.todo} \xB7 in progress ${board.items.inProgress} \xB7 done ${board.items.done}` + (board.items.truncated ? " (counted over its first 500 items)" : "") : "none";
-  return [
-    "## Plan",
-    "",
-    `- plan.md: ${file ? `${file.path} \u2014 ${fileSource(file)}` : "none"}`,
-    `- Draft: ${draftId ?? "none"}`,
-    `- Board: ${boardLine}`
-  ].join("\n");
+  for (const r of spec.requirements ?? []) {
+    parts.push(`**${r.name}**
+
+${r.content}`);
+  }
+  if (spec.taskContent) {
+    parts.push(`**Tasks**
+
+${spec.taskContent}`);
+  }
+  const body = parts.join("\n\n").trim();
+  if (!body) throw new Error("spec has no content");
+  return body;
 }
-function releaseSection(change) {
-  const lines = change.release.prs.map(
-    (pr) => `- ${prLink(pr)} \xB7 ${pr.title} \xB7 ` + (pr.approvingReview ? `approved by ${pr.approvingReview.by} at ${pr.approvingReview.at}` : "no approving review on its head yet")
+async function fetchDocBody(api, docId, anchor) {
+  const doc = await api.get(
+    `/v1/docs/${encodeURIComponent(docId)}/content`,
+    anchor ? { section: anchor } : void 0
   );
-  return `## Release
-
-${lines.length > 0 ? lines.join("\n") : "No release pull request is open."}`;
+  if (doc.error) throw new Error(doc.error);
+  const body = (doc.content ?? "").trim();
+  if (!body) throw new Error("document is empty");
+  return body;
 }
-function formatChange(change) {
-  const header = `# ${change.title}
-
-\`${change.key}\` \xB7 size: ${change.size}` + (change.archived ? " \xB7 archived: read-only, done" : "") + ` \xB7 synced ${change.syncedAt}`;
-  return [
-    header,
-    partsTable(change),
-    decisionSection(change),
-    contractSection(change),
-    behaviourSection(change),
-    planSection(change),
-    releaseSection(change),
-    // Compact: a change's every scenario with its steps rides in this block.
-    "```json\n" + JSON.stringify(change) + "\n```",
-    briefVerdict(change.states)
-  ].join("\n\n");
+function githubDeepLink(repoFullName, path, anchor) {
+  return `https://github.com/${repoFullName}/blob/HEAD/${path}#${anchor}`;
 }
-function registerGetChange(server, apiClient) {
-  server.registerTool(
-    "get_change",
-    {
-      title: "Get Change",
-      description: `Read one change (a specs/changes/<slug>/ folder of a connected repository) as SystemDox last synced it from GitHub: the state of each part of its brief (decision, contract, behaviour, plan) and of its release, each with its pull request; the decision's ADR and status; the contract files; every feature file that names the change, with its scenarios as id \xB7 state \xB7 title; the plan (plan.md, the draft, the board); the release pull requests; and the Change object as JSON. The last line says "The brief is passed" or "The brief is not passed: <part> is <state>". Call it before building a story, and stop if the brief is not passed or the story's scenarios are not proposed. Read-only.`,
-      inputSchema: {
-        repo: z6.string().regex(REPO_RE, "the repository as owner/name, e.g. acme/booking-api").describe("The repository that holds the change, as owner/name"),
-        slug: z6.string().max(SLUG_MAX).regex(SLUG_RE2, "a change folder's name: lower-case words joined by -, e.g. customer-reminders").describe("The change's folder name: specs/changes/<slug>/")
-      },
-      annotations: { readOnlyHint: true }
-    },
-    async ({ repo, slug }) => {
-      const [owner, name] = repo.split("/");
-      let change;
-      try {
-        change = await apiClient.getFresh(
-          `/v1/changes/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/${encodeURIComponent(slug)}`
-        );
-      } catch (err) {
-        if (err.status === 404) {
-          return {
-            content: [{ type: "text", text: `No such change ${repo}/${slug}` }],
-            isError: true
-          };
-        }
-        throw err;
-      }
-      return { content: [{ type: "text", text: formatChange(change) }] };
+function formatSectionPointer(repoFullName, path, s) {
+  return `\`${path}#${s.anchor}\` \xB7 \`chunk_id: ${s.chunkId}\` \xB7 [${s.heading}](${githubDeepLink(repoFullName, path, s.anchor)})`;
+}
+var SECTION_STOP_WORDS = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "of",
+  "to",
+  "and",
+  "or",
+  "for",
+  "in",
+  "on",
+  "with",
+  "how",
+  "why",
+  "what",
+  "add",
+  "new",
+  "use",
+  "using",
+  "update",
+  "fix"
+]);
+function selectSection(outline, taskDescription) {
+  if (!outline || outline.length === 0) return void 0;
+  const keywords = taskDescription.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !SECTION_STOP_WORDS.has(w));
+  let best = outline[0];
+  let bestScore = -1;
+  for (const s of outline) {
+    const heading = s.heading.toLowerCase();
+    let score = 0;
+    for (const kw of keywords) if (heading.includes(kw)) score++;
+    if (score > bestScore) {
+      best = s;
+      bestScore = score;
     }
-  );
+  }
+  return best;
+}
+async function hydrate(api, item, meta) {
+  try {
+    const body = meta.type === "spec" ? await fetchSpecBody(api, meta.id) : await fetchDocBody(api, meta.id, meta.section?.anchor);
+    return { item, meta, body };
+  } catch (err) {
+    return {
+      item,
+      meta,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
 }
+async function buildContext(api, { taskDescription, filePaths = [], maxTokens }) {
+  const budget = maxTokens ?? DEFAULT_BUDGET;
+  const failures = [];
+  const orEmpty = (empty) => (err) => {
+    failures.push(err);
+    return empty;
+  };
+  const [rawGuardrails, rawSpecs, docs, stack, rules, docRepos] = await Promise.all([
+    api.get("/v1/guardrails").catch(orEmpty([])),
+    api.get("/v1/specs").catch(orEmpty([])),
+    findDocs(api, taskDescription).catch(
+      orEmpty({ items: [], searched: false })
+    ),
+    api.get("/v1/ai/settings/stack").catch(orEmpty([])),
+    api.get("/v1/standards/rules").catch(orEmpty([])),
+    // Capability states — FAIL-OPEN: an unreadable config (older backend, a
+    // blip) gates nothing, it can never hide working context.
+    api.get("/v1/doc-repos").catch(() => null)
+  ]);
+  if (failures.length === 5) throw failures[0];
+  const disabled = (key2) => docRepos?.capabilities?.[key2]?.status === "disabled";
+  const guardrails = disabled("fitness") ? [] : rawGuardrails;
+  const specs = disabled("requirements") && disabled("design") && disabled("specs") ? [] : rawSpecs;
+  const refs = /* @__PURE__ */ new Map();
+  const key = (type, id) => `${type}:${id}`;
+  const docTitles = new Set(docs.items.map((d) => d.title));
+  const isCopyOfDoc = (s) => isDecisionDraft(s.name) && docTitles.has(s.name.slice("ADR: ".length));
+  const scorable = [
+    ...guardrails.map((g) => ({
+      type: "guardrail",
+      id: g.id,
+      title: g.title,
+      content: formatGuardrail(g),
+      category: g.category,
+      severity: g.severity,
+      updatedAt: g.updatedAt
+    })),
+    ...specs.filter((s) => s.status !== "archived" && !isCopyOfDoc(s)).map((s) => {
+      refs.set(key("spec", s.draftId), {
+        type: "spec",
+        id: s.draftId,
+        title: s.name,
+        listLine: `- **${s.name}** \u2014 \`draft_id: ${s.draftId}\` (${s.status}, ${specLabel(s)})`,
+        fetchHint: `get_specs(draft_id="${s.draftId}")`
+      });
+      return {
+        type: "spec",
+        id: s.draftId,
+        title: s.name,
+        content: formatSpecHeadline(s),
+        updatedAt: s.updatedAt
+      };
+    }),
+    ...docs.items.map((d, position) => {
+      const section = selectSection(d.outline, taskDescription);
+      const pointer = section ? formatSectionPointer(d.repo_full_name, d.path, section) : void 0;
+      refs.set(key("doc", d.id), {
+        type: "doc",
+        id: d.id,
+        title: d.title,
+        section,
+        pointer,
+        listLine: `- **${d.title}** \u2014 \`doc_id: ${d.id}\` (\`${d.repo_full_name}/${d.path}\`)` + (pointer ? `
+  \u21B3 ${pointer}` : ""),
+        fetchHint: section ? `get_docs(doc_id="${d.id}", section="${section.anchor}")` : `get_docs(doc_id="${d.id}")`
+      });
+      return {
+        type: "doc",
+        id: d.id,
+        title: d.title,
+        content: formatDocHeadline(d),
+        category: d.doc_type === "adr" ? "architecture" : void 0,
+        updatedAt: d.synced_at,
+        path: d.path,
+        relevance: docs.searched ? 1 - position / (2 * docs.items.length) : void 0
+      };
+    })
+  ];
+  const ranked = scoreItems(scorable, taskDescription, filePaths);
+  const sections = [];
+  let overhead = 0;
+  if (stack.length > 0) {
+    const { text: text3, hidden } = selectStack(
+      stack,
+      [...extractKeywords(taskDescription), ...detectLanguages(filePaths)],
+      Math.floor(budget * STACK_SHARE)
+    );
+    const section = `## Tech Stack
 
-// src/tools/get-context.ts
-import { z as z7 } from "zod";
+${text3}` + (hidden > 0 ? `
 
-// src/lib/scoring.ts
-var WEIGHT_PATH = 0.4;
-var WEIGHT_KEYWORD = 0.3;
-var WEIGHT_RECENCY = 0.15;
-var WEIGHT_SEVERITY = 0.15;
-var SEVERITY_SCORES = {
-  critical: 1,
-  high: 0.75,
-  medium: 0.5,
-  low: 0.25
-};
-var MIN_TITLE_SHARE = 1 / 3;
-var RECORD_PATH = /(^|\/)changelog\//;
-var RECORD_FACTOR = 0.5;
-var CHARS_PER_TOKEN = 4;
-function estimateTokens(text3) {
-  return Math.ceil(text3.length / CHARS_PER_TOKEN);
-}
-function truncateToTokens(text3, maxTokens) {
-  const maxChars = Math.max(0, maxTokens) * CHARS_PER_TOKEN;
-  if (text3.length <= maxChars) return { text: text3, truncated: false };
-  const head = text3.slice(0, maxChars);
-  const floor = Math.floor(maxChars * 0.75);
-  const paragraph = head.lastIndexOf("\n\n");
-  const line = head.lastIndexOf("\n");
-  let cut = maxChars;
-  if (paragraph >= floor) cut = paragraph;
-  else if (line >= floor) cut = line;
-  return { text: head.slice(0, cut).trimEnd(), truncated: true };
-}
-function scorePathMatch(item, languages, categories) {
-  if (languages.length === 0 && categories.length === 0) return 0.5;
-  let score = 0;
-  const itemLang = item.language?.toLowerCase() ?? "";
-  const itemCat = item.category?.toLowerCase() ?? "";
-  if (itemLang && languages.some((l) => itemLang.includes(l))) {
-    score += 0.6;
-  }
-  if (itemCat && categories.some((c) => itemCat.includes(c))) {
-    score += 0.4;
+_${hidden} more with \`get_tech_stack\`._` : "");
+    sections.push(section);
+    overhead += estimateTokens(section);
   }
-  return Math.min(score, 1);
-}
-function scoreKeywordMatch(item, keywords) {
-  if (keywords.length === 0) return 0;
-  const searchable = `${item.title} ${item.content}`.toLowerCase();
-  let matches = 0;
-  for (const kw of keywords) {
-    if (searchable.includes(kw)) matches++;
+  if (rules.length > 0) {
+    const section = formatRules(rules);
+    sections.push(section);
+    overhead += estimateTokens(section);
   }
-  return Math.min(matches / keywords.length, 1);
-}
-function scoreRecency(item) {
-  if (!item.updatedAt) return 0.5;
-  const now = Date.now();
-  const updated = new Date(item.updatedAt).getTime();
-  const daysSince = (now - updated) / (1e3 * 60 * 60 * 24);
-  if (daysSince <= 7) return 1;
-  if (daysSince <= 30) return 0.75;
-  if (daysSince <= 90) return 0.5;
-  return 0.25;
-}
-function scoreSeverity(item) {
-  if (!item.severity) return 0.5;
-  return SEVERITY_SCORES[item.severity] ?? 0.5;
-}
-function stem(word) {
-  return word.length > 3 ? word.replace(/s$/, "") : word;
-}
-function stems(text3) {
-  return new Set(
-    text3.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean).map(stem)
+  let remaining = budget - RESERVE_TOKENS - overhead;
+  const rankedGuardrails = ranked.filter((i) => i.type === "guardrail");
+  const { selected: selectedGuardrails, tokensUsed: guardrailTokens } = selectWithinBudget(
+    rankedGuardrails,
+    Math.max(0, Math.floor(remaining * GUARDRAIL_SHARE))
   );
-}
-function titleShare(title, keywords) {
-  const wanted = stems(keywords.join(" "));
-  if (wanted.size === 0) return 0;
-  const held = stems(title);
-  let matches = 0;
-  for (const word of wanted) {
-    if (held.has(word)) matches++;
+  remaining -= guardrailTokens;
+  const rankedRefs = ranked.filter(
+    (i) => i.type === "spec" || i.type === "doc"
+  );
+  const avgHeadline = rankedRefs.length ? Math.ceil(
+    rankedRefs.slice(0, MAX_HYDRATED).reduce((sum, i) => sum + i.tokenEstimate, 0) / Math.min(rankedRefs.length, MAX_HYDRATED)
+  ) : 0;
+  const affordable = Math.floor(
+    Math.max(0, remaining) / (MIN_BODY_TOKENS + avgHeadline)
+  );
+  const shortlist = rankedRefs.slice(
+    0,
+    Math.max(0, Math.min(MAX_HYDRATED, affordable))
+  );
+  for (const item of shortlist) {
+    remaining -= item.tokenEstimate;
   }
-  return matches / wanted.size;
-}
-function scoreReference(item, keywords) {
-  const share = titleShare(item.title, keywords);
-  const score = Math.max(
-    item.relevance ?? 0,
-    share >= MIN_TITLE_SHARE ? share : 0
+  remaining = Math.max(0, remaining);
+  const hydrated = await Promise.all(
+    shortlist.map(
+      (item) => hydrate(api, item, refs.get(key(item.type, item.id)))
+    )
   );
-  return RECORD_PATH.test(item.path ?? "") ? score * RECORD_FACTOR : score;
-}
-function extractKeywords(text3) {
-  const stopWords = /* @__PURE__ */ new Set([
-    "the",
-    "a",
-    "an",
-    "is",
-    "are",
-    "was",
-    "were",
-    "be",
-    "been",
-    "being",
-    "have",
-    "has",
-    "had",
-    "do",
-    "does",
-    "did",
-    "will",
-    "would",
-    "could",
-    "should",
-    "may",
-    "might",
-    "can",
-    "shall",
-    "to",
-    "of",
-    "in",
-    "for",
-    "on",
-    "with",
-    "at",
-    "by",
-    "from",
-    "as",
-    "into",
-    "about",
-    "between",
-    "through",
-    "after",
-    "before",
-    "during",
-    "without",
-    "this",
-    "that",
-    "these",
-    "those",
-    "it",
-    "its",
-    "and",
-    "or",
-    "but",
-    "not",
-    "no",
-    "all",
-    "each",
-    "every",
-    "both",
-    "few",
-    "more",
-    "most",
-    "other",
-    "some",
-    "such",
-    "than",
-    "too",
-    "very",
-    "just",
-    "also",
-    "only",
-    "new",
-    "add",
-    "update",
-    "fix",
-    "change",
-    "make",
-    "use",
-    "get",
-    "set",
-    "need",
-    "want",
-    "implement",
-    "create"
-  ]);
-  return text3.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !stopWords.has(w));
-}
-function scoreItems(items, taskDescription, filePaths) {
-  const languages = detectLanguages(filePaths);
-  const categories = detectCategories(filePaths);
-  const keywords = extractKeywords(taskDescription);
-  return items.map((item) => {
-    const pathScore = scorePathMatch(item, languages, categories);
-    const keywordScore = scoreKeywordMatch(item, keywords);
-    const recencyScore = scoreRecency(item);
-    const severityScore = scoreSeverity(item);
-    const isReference = item.type === "spec" || item.type === "doc";
-    const score = isReference && keywords.length > 0 ? scoreReference(item, keywords) : pathScore * WEIGHT_PATH + keywordScore * WEIGHT_KEYWORD + recencyScore * WEIGHT_RECENCY + severityScore * WEIGHT_SEVERITY;
-    return {
-      type: item.type,
-      id: item.id,
-      title: item.title,
-      content: item.content,
-      score,
-      tokenEstimate: estimateTokens(item.content)
+  const tailCandidates = rankedRefs.slice(shortlist.length, shortlist.length + MAX_TAIL).map((i) => refs.get(key(i.type, i.id)));
+  const tailCost = tailCandidates.reduce(
+    (sum, m) => sum + estimateTokens(m.listLine),
+    0
+  );
+  const tailReserve = Math.min(
+    tailCost,
+    Math.floor(remaining * TAIL_SHARE)
+  );
+  const bodyBudgetStart = Math.max(0, remaining - tailReserve);
+  let bodyBudget = bodyBudgetStart;
+  let itemsLeft = hydrated.length;
+  let itemsWithBody = 0;
+  let bodyFailures = 0;
+  const blocks = [];
+  for (const h of hydrated) {
+    itemsLeft--;
+    const headline = h.meta.pointer ? `${h.item.content}
+${h.meta.pointer}` : h.item.content;
+    const emit = (block) => {
+      bodyBudget -= Math.max(
+        0,
+        estimateTokens(block) - h.item.tokenEstimate
+      );
+      blocks.push(block);
     };
-  }).filter((item) => item.score > 0).sort((a, b) => b.score - a.score);
-}
-function selectWithinBudget(items, maxTokens) {
-  const selected = [];
-  let tokensUsed = 0;
-  for (const item of items) {
-    if (tokensUsed + item.tokenEstimate > maxTokens) continue;
-    selected.push(item);
-    tokensUsed += item.tokenEstimate;
+    if (h.error !== void 0) {
+      bodyFailures++;
+      emit(
+        `${headline}
+
+_Body unavailable (${h.error}) \u2014 retry with \`${h.meta.fetchHint}\`._`
+      );
+      continue;
+    }
+    const available = Math.max(0, bodyBudget);
+    const allowance = Math.min(
+      Math.max(MIN_BODY_TOKENS, Math.floor(available / (itemsLeft + 1))),
+      available
+    );
+    if (allowance < MIN_BODY_TOKENS) {
+      emit(
+        `${headline}
+
+_Body omitted (token budget exhausted) \u2014 fetch with \`${h.meta.fetchHint}\`._`
+      );
+      continue;
+    }
+    const { text: body2, truncated } = truncateToTokens(
+      h.body,
+      allowance - TRUNCATION_NOTICE_TOKENS
+    );
+    itemsWithBody++;
+    emit(
+      `${headline}
+
+${body2}` + (truncated ? `
+
+_[truncated to fit the token budget \u2014 full text via \`${h.meta.fetchHint}\`]_` : "")
+    );
   }
-  return { selected, tokensUsed, totalItems: items.length };
-}
+  remaining = Math.max(0, remaining - (bodyBudgetStart - bodyBudget));
+  if (selectedGuardrails.length > 0) {
+    sections.push(
+      `## Checks (${selectedGuardrails.length})
 
-// src/lib/context-builder.ts
-var DEFAULT_BUDGET = 4e3;
-var RESERVE_TOKENS = 200;
-var GUARDRAIL_SHARE = 0.35;
-var MIN_BODY_TOKENS = 150;
-var MAX_HYDRATED = 8;
-var MAX_TAIL = 10;
-var TAIL_SHARE = 0.15;
-var TRUNCATION_NOTICE_TOKENS = 30;
-var STACK_SHARE = 0.1;
-var MIN_REFERENCES = 3;
-var SEARCH_RESULTS = 30;
-var MAX_QUERY_CHARS = 300;
-function formatGuardrail(g) {
-  let text3 = `## ${g.title} [${g.severity}]
+` + selectedGuardrails.map((i) => i.content).join("\n\n---\n\n")
+    );
+  }
+  if (blocks.length > 0) {
+    sections.push(
+      `## Relevant Specs & Docs (${blocks.length})
 
-${g.description}`;
-  if (g.pattern) text3 += `
+_Highest-ranked items \u2014 docs are scoped to their most relevant section. Each carries the ID / \`chunk_id\` to fetch more._
 
-**Bad:** \`\`\`
-${g.pattern}
-\`\`\``;
-  if (g.fix) text3 += `
+` + blocks.join("\n\n---\n\n")
+    );
+  }
+  const tailLines = [];
+  for (const meta of tailCandidates) {
+    const cost = estimateTokens(meta.listLine);
+    const named = blocks.length + tailLines.length;
+    if (cost > remaining && named >= MIN_REFERENCES) break;
+    tailLines.push(meta.listLine);
+    remaining = Math.max(0, remaining - cost);
+  }
+  if (tailLines.length > 0) {
+    sections.push(
+      `## Also Indexed (${tailLines.length})
 
-**Good:** \`\`\`
-${g.fix}
-\`\`\``;
-  return text3;
+_Ranked lower \u2014 fetch with \`get_specs\` / \`get_docs\` if you need them._
+
+` + tailLines.join("\n")
+    );
+  }
+  const itemsListed = blocks.length - itemsWithBody + tailLines.length;
+  const itemsOmitted = ranked.length - selectedGuardrails.length - blocks.length - tailLines.length;
+  const body = sections.join("\n\n");
+  const tokensUsed = estimateTokens(body);
+  const stats = {
+    budget,
+    tokensUsed,
+    itemsWithBody,
+    bodyFailures,
+    itemsListed,
+    itemsOmitted: Math.max(0, itemsOmitted),
+    guardrails: selectedGuardrails.length
+  };
+  if (sections.length === 0) {
+    const text3 = failures.length ? `No context found for this task, but ${failures.length} of 5 reads failed, so this is not an all-clear: the team's rules may not have been read.` : "No relevant context found for this task.";
+    return { text: text3, stats };
+  }
+  const footer = `
+
+---
+_Context: ${itemsWithBody} full text, ${itemsListed} listed, ${stats.itemsOmitted} omitted \xB7 ~${tokensUsed} of ${budget} tokens` + (bodyFailures > 0 ? ` \xB7 ${bodyFailures} body fetch(es) failed` : "") + (failures.length > 0 ? ` \xB7 ${failures.length} of 5 reads failed` : "") + `_`;
+  return { text: body + footer, stats };
 }
-function formatSpecHeadline(s) {
-  return `### ${s.name}
-\`draft_id: ${s.draftId}\` \xB7 ${s.status} \xB7 ${specLabel(s)}`;
+
+// src/tools/get-context.ts
+function registerGetContext(server, apiClient) {
+  server.registerTool(
+    "get_context",
+    {
+      title: "Get Context",
+      description: "Intelligent context aggregator: fetches checks, specs, docs, and tech stack, ranks them by relevance to your current task, and returns the full text of the highest-ranked items within a token budget \u2014 each with the ID needed to fetch the rest. Use this instead of calling individual tools when you want curated, relevant context.",
+      inputSchema: {
+        task_description: z7.string().describe(
+          "What you're working on (e.g., 'add a new REST endpoint for user preferences')"
+        ),
+        file_paths: z7.array(z7.string()).optional().describe(
+          "File paths being edited \u2014 used for language/category detection"
+        ),
+        max_tokens: z7.number().optional().describe("Maximum token budget for the response (default: 4000)")
+      }
+    },
+    async ({ task_description, file_paths, max_tokens }) => {
+      const { text: text3 } = await buildContext(apiClient, {
+        taskDescription: task_description,
+        filePaths: file_paths,
+        maxTokens: max_tokens
+      });
+      return {
+        content: [{ type: "text", text: text3 }]
+      };
+    }
+  );
 }
-function formatDocHeadline(d) {
-  return `### ${d.title}
-\`doc_id: ${d.id}\` \xB7 \`${d.repo_full_name}/${d.path}\` \xB7 ${d.doc_type}`;
+
+// src/lib/session-brief.ts
+import { existsSync as existsSync2 } from "fs";
+import { readFile as readFile3 } from "fs/promises";
+import { join as join3 } from "path";
+
+// src/lib/skills.ts
+import { createHash } from "crypto";
+import { lstat, mkdir, readdir, readFile, rm, writeFile } from "fs/promises";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { dirname, join, relative, resolve, sep } from "path";
+var MANIFEST_FILE = ".systemdox-skill.json";
+var ENTRY_FILE = "SKILL.md";
+var PLUGIN_MANIFEST_FOLDER = ".claude-plugin";
+var MAX_FILES = 100;
+var MAX_FILE_BYTES = 256 * 1024;
+var MAX_TOTAL_BYTES = 1024 * 1024;
+var NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var SEGMENT_RE = /^[A-Za-z0-9._-]+$/;
+var SKIPPED = /* @__PURE__ */ new Set([MANIFEST_FILE, ".git", "node_modules", "__pycache__", ".DS_Store"]);
+var SkillInstallRefused = class extends Error {
+  constructor(dest, edited) {
+    super(
+      `${dest} has local changes in ${edited.length} file(s): ${edited.join(", ")}. Nothing was written. Move your changes aside, or install again with overwrite.`
+    );
+    this.dest = dest;
+    this.edited = edited;
+  }
+  dest;
+  edited;
+};
+function sha256(content) {
+  return createHash("sha256").update(content, "utf8").digest("hex");
 }
-function formatStack(entries2) {
-  return entries2.map(
-    (e) => `- ${e.name}${e.version ? ` v${e.version}` : ""}${e.notes ? ` \u2014 ${e.notes}` : ""}`
-  ).join("\n");
+function isValidName(name) {
+  return name.length <= 64 && NAME_RE.test(name);
 }
-function selectStack(entries2, words, maxTokens) {
-  const named = (e) => {
-    const entry = `${e.name} ${e.notes ?? ""}`.toLowerCase();
-    return words.some((w) => entry.includes(w));
-  };
-  const ordered = [...entries2.filter(named), ...entries2.filter((e) => !named(e))];
-  const shown = [];
-  for (const entry of ordered) {
-    if (shown.length > 0 && estimateTokens(formatStack([...shown, entry])) > maxTokens) {
-      break;
-    }
-    shown.push(entry);
-  }
-  return { text: formatStack(shown), hidden: entries2.length - shown.length };
+function isValidPath(path) {
+  return path.length > 0 && path.length <= 512 && !path.startsWith("/") && path.split("/").every((s) => SEGMENT_RE.test(s) && s !== "." && s !== ".." && s !== PLUGIN_MANIFEST_FOLDER);
 }
-function formatRules(rules) {
-  const byCategory = /* @__PURE__ */ new Map();
-  for (const r of rules) {
-    const cat = r.category || "other";
-    if (!byCategory.has(cat)) byCategory.set(cat, []);
-    byCategory.get(cat).push(r);
-  }
-  let text3 = "";
-  for (const [cat, catRules] of byCategory) {
-    text3 += `### ${cat.charAt(0).toUpperCase() + cat.slice(1)}
-`;
-    for (const r of catRules) {
-      text3 += `- ${r.text}
-`;
-    }
-    text3 += "\n";
+function frontmatterName(skillMd) {
+  const block = /^---\r?\n([\s\S]*?)\r?\n---/.exec(skillMd);
+  if (!block) return void 0;
+  const line = /^name:[ \t]*(.+?)[ \t]*$/m.exec(block[1]);
+  return line ? line[1].replace(/^(['"])(.*)\1$/, "$2") : void 0;
+}
+function defaultSkillDir(name) {
+  return join(homedir(), ".claude", "skills", name);
+}
+async function walk(root, { skipHidden }, dir = root, out = { files: [], links: [], hidden: [] }) {
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    if (SKIPPED.has(entry.name) || entry.name.endsWith(".pyc")) continue;
+    const full = join(dir, entry.name);
+    const rel = relative(root, full).split(sep).join("/");
+    if (entry.isSymbolicLink()) out.links.push(rel);
+    else if (skipHidden && entry.name.startsWith(".")) out.hidden.push(rel);
+    else if (entry.isDirectory()) await walk(root, { skipHidden }, full, out);
+    else if (entry.isFile()) out.files.push(rel);
   }
-  return `## Project Rules (${rules.length})
-
-${text3.trim()}`;
+  out.files.sort();
+  return out;
 }
-async function findDocs(api, taskDescription) {
-  const query = taskDescription.trim().slice(0, MAX_QUERY_CHARS);
-  if (query) {
+async function readTextFiles(root, paths, what) {
+  if (paths.length > MAX_FILES) {
+    throw new Error(`${root} holds ${paths.length} files: ${what} holds at most ${MAX_FILES}`);
+  }
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  const files = [];
+  let total = 0;
+  for (const path of paths) {
+    if (!isValidPath(path)) {
+      throw new Error(`${path}: file names may use letters, digits, ".", "_" and "-" only`);
+    }
+    const raw = await readFile(join(root, ...path.split("/")));
+    if (raw.includes(0)) throw new Error(`${path} is binary: ${what} holds text files only`);
+    if (raw.length > MAX_FILE_BYTES) {
+      throw new Error(`${path} is ${raw.length} bytes: a file holds at most ${MAX_FILE_BYTES}`);
+    }
+    total += raw.length;
+    if (total > MAX_TOTAL_BYTES) {
+      throw new Error(`the files pass ${MAX_TOTAL_BYTES} bytes at ${path}`);
+    }
+    let content;
     try {
-      const found = await api.get("/v1/docs", {
-        q: query,
-        limit: String(SEARCH_RESULTS)
-      });
-      if (found.items.length > 0) return { ...found, searched: true };
+      content = decoder.decode(raw);
     } catch {
+      throw new Error(`${path} is not UTF-8 text`);
     }
+    files.push({ path, content });
   }
-  const listed = await api.get("/v1/docs");
-  return { ...listed, searched: false };
+  return files;
 }
-async function fetchSpecBody(api, draftId) {
-  const spec = await api.get(
-    `/v1/specs/${encodeURIComponent(draftId)}`
-  );
-  const parts = [];
-  if (spec.proposalContent) {
-    parts.push(`**Proposal**
-
-${spec.proposalContent}`);
-  }
-  for (const r of spec.requirements ?? []) {
-    parts.push(`**${r.name}**
-
-${r.content}`);
+async function readSkillDirectory(directory) {
+  const root = resolve(directory);
+  if (!existsSync(join(root, ENTRY_FILE))) {
+    throw new Error(`${root} has no ${ENTRY_FILE}: a skill folder holds SKILL.md at its root`);
   }
-  if (spec.taskContent) {
-    parts.push(`**Tasks**
-
-${spec.taskContent}`);
+  const walked = await walk(root, { skipHidden: true });
+  if (walked.links.length) {
+    throw new Error(`${walked.links.join(", ")}: links are not followed; copy the file into the skill folder`);
   }
-  const body = parts.join("\n\n").trim();
-  if (!body) throw new Error("spec has no content");
-  return body;
-}
-async function fetchDocBody(api, docId, anchor) {
-  const doc = await api.get(
-    `/v1/docs/${encodeURIComponent(docId)}/content`,
-    anchor ? { section: anchor } : void 0
-  );
-  if (doc.error) throw new Error(doc.error);
-  const body = (doc.content ?? "").trim();
-  if (!body) throw new Error("document is empty");
-  return body;
-}
-function githubDeepLink(repoFullName, path, anchor) {
-  return `https://github.com/${repoFullName}/blob/HEAD/${path}#${anchor}`;
-}
-function formatSectionPointer(repoFullName, path, s) {
-  return `\`${path}#${s.anchor}\` \xB7 \`chunk_id: ${s.chunkId}\` \xB7 [${s.heading}](${githubDeepLink(repoFullName, path, s.anchor)})`;
+  const files = await readTextFiles(root, walked.files, "a skill");
+  const skillMd = files.find((f) => f.path === ENTRY_FILE);
+  const name = frontmatterName(skillMd.content);
+  if (!name) throw new Error(`${ENTRY_FILE} has no frontmatter name`);
+  return { name, files, skipped: walked.hidden };
 }
-var SECTION_STOP_WORDS = /* @__PURE__ */ new Set([
-  "the",
-  "a",
-  "an",
-  "of",
-  "to",
-  "and",
-  "or",
-  "for",
-  "in",
-  "on",
-  "with",
-  "how",
-  "why",
-  "what",
-  "add",
-  "new",
-  "use",
-  "using",
-  "update",
-  "fix"
-]);
-function selectSection(outline, taskDescription) {
-  if (!outline || outline.length === 0) return void 0;
-  const keywords = taskDescription.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length > 2 && !SECTION_STOP_WORDS.has(w));
-  let best = outline[0];
-  let bestScore = -1;
-  for (const s of outline) {
-    const heading = s.heading.toLowerCase();
-    let score = 0;
-    for (const kw of keywords) if (heading.includes(kw)) score++;
-    if (score > bestScore) {
-      best = s;
-      bestScore = score;
-    }
-  }
-  return best;
+function within(dest, path) {
+  if (!isValidPath(path)) throw new Error(`refusing to write ${JSON.stringify(path)}: not a skill path`);
+  const full = resolve(dest, ...path.split("/"));
+  if (!full.startsWith(resolve(dest) + sep)) throw new Error(`refusing to write outside ${dest}: ${path}`);
+  return full;
 }
-async function hydrate(api, item, meta) {
+async function readManifest(dest) {
   try {
-    const body = meta.type === "spec" ? await fetchSpecBody(api, meta.id) : await fetchDocBody(api, meta.id, meta.section?.anchor);
-    return { item, meta, body };
-  } catch (err) {
-    return {
-      item,
-      meta,
-      error: err instanceof Error ? err.message : String(err)
-    };
+    return JSON.parse(await readFile(join(dest, MANIFEST_FILE), "utf8"));
+  } catch {
+    return void 0;
   }
 }
-async function buildContext(api, { taskDescription, filePaths = [], maxTokens }) {
-  const budget = maxTokens ?? DEFAULT_BUDGET;
-  const failures = [];
-  const orEmpty = (empty) => (err) => {
-    failures.push(err);
-    return empty;
-  };
-  const [rawGuardrails, rawSpecs, docs, stack, rules, docRepos] = await Promise.all([
-    api.get("/v1/guardrails").catch(orEmpty([])),
-    api.get("/v1/specs").catch(orEmpty([])),
-    findDocs(api, taskDescription).catch(
-      orEmpty({ items: [], searched: false })
-    ),
-    api.get("/v1/ai/settings/stack").catch(orEmpty([])),
-    api.get("/v1/standards/rules").catch(orEmpty([])),
-    // Capability states — FAIL-OPEN: an unreadable config (older backend, a
-    // blip) gates nothing, it can never hide working context.
-    api.get("/v1/doc-repos").catch(() => null)
-  ]);
-  if (failures.length === 5) throw failures[0];
-  const disabled = (key2) => docRepos?.capabilities?.[key2]?.status === "disabled";
-  const guardrails = disabled("fitness") ? [] : rawGuardrails;
-  const specs = disabled("requirements") && disabled("design") && disabled("specs") ? [] : rawSpecs;
-  const refs = /* @__PURE__ */ new Map();
-  const key = (type, id) => `${type}:${id}`;
-  const docTitles = new Set(docs.items.map((d) => d.title));
-  const isCopyOfDoc = (s) => isDecisionDraft(s.name) && docTitles.has(s.name.slice("ADR: ".length));
-  const scorable = [
-    ...guardrails.map((g) => ({
-      type: "guardrail",
-      id: g.id,
-      title: g.title,
-      content: formatGuardrail(g),
-      category: g.category,
-      severity: g.severity,
-      updatedAt: g.updatedAt
-    })),
-    ...specs.filter((s) => s.status !== "archived" && !isCopyOfDoc(s)).map((s) => {
-      refs.set(key("spec", s.draftId), {
-        type: "spec",
-        id: s.draftId,
-        title: s.name,
-        listLine: `- **${s.name}** \u2014 \`draft_id: ${s.draftId}\` (${s.status}, ${specLabel(s)})`,
-        fetchHint: `get_specs(draft_id="${s.draftId}")`
-      });
-      return {
-        type: "spec",
-        id: s.draftId,
-        title: s.name,
-        content: formatSpecHeadline(s),
-        updatedAt: s.updatedAt
-      };
-    }),
-    ...docs.items.map((d, position) => {
-      const section = selectSection(d.outline, taskDescription);
-      const pointer = section ? formatSectionPointer(d.repo_full_name, d.path, section) : void 0;
-      refs.set(key("doc", d.id), {
-        type: "doc",
-        id: d.id,
-        title: d.title,
-        section,
-        pointer,
-        listLine: `- **${d.title}** \u2014 \`doc_id: ${d.id}\` (\`${d.repo_full_name}/${d.path}\`)` + (pointer ? `
-  \u21B3 ${pointer}` : ""),
-        fetchHint: section ? `get_docs(doc_id="${d.id}", section="${section.anchor}")` : `get_docs(doc_id="${d.id}")`
-      });
-      return {
-        type: "doc",
-        id: d.id,
-        title: d.title,
-        content: formatDocHeadline(d),
-        category: d.doc_type === "adr" ? "architecture" : void 0,
-        updatedAt: d.synced_at,
-        path: d.path,
-        relevance: docs.searched ? 1 - position / (2 * docs.items.length) : void 0
-      };
-    })
+async function installSkill(version, dest, { overwrite = false } = {}) {
+  if (!isValidName(version.name)) throw new Error(`refusing to install ${JSON.stringify(version.name)}: not a skill name`);
+  const incoming = new Map(version.files.map((f) => [f.path, f]));
+  for (const f of version.files) within(dest, f.path);
+  if (existsSync(dest) && (await lstat(dest)).isSymbolicLink()) {
+    throw new Error(`${dest} is a link: install into a real folder`);
+  }
+  const walked = existsSync(dest) ? await walk(dest, { skipHidden: false }) : { files: [], links: [], hidden: [] };
+  if (walked.links.length) {
+    throw new Error(`${dest} holds links (${walked.links.join(", ")}): remove them, nothing was written`);
+  }
+  const present = walked.files;
+  const manifest = await readManifest(dest);
+  const known2 = Object.fromEntries(
+    Object.entries(manifest?.files ?? {}).filter(([p, h]) => isValidPath(p) && typeof h === "string")
+  );
+  const edited = [];
+  const untracked = [];
+  for (const path of present) {
+    const content = await readFile(join(dest, ...path.split("/")), "utf8");
+    if (Object.hasOwn(known2, path)) {
+      if (sha256(content) !== known2[path]) edited.push(path);
+    } else if (!incoming.has(path) || sha256(content) !== incoming.get(path).sha256) {
+      if (incoming.has(path) || !manifest) edited.push(path);
+      else untracked.push(path);
+    }
+  }
+  const blocking = edited.filter((p) => incoming.has(p) || !manifest);
+  if (blocking.length && !overwrite) throw new SkillInstallRefused(dest, blocking);
+  const written = [];
+  for (const f of version.files) {
+    const full = within(dest, f.path);
+    await mkdir(dirname(full), { recursive: true });
+    await writeFile(full, f.content, "utf8");
+    written.push(f.path);
+  }
+  const removed = [];
+  const keptEdited = [];
+  for (const path of Object.keys(known2)) {
+    if (incoming.has(path) || !present.includes(path)) continue;
+    if (edited.includes(path)) {
+      keptEdited.push(path);
+      continue;
+    }
+    await rm(within(dest, path));
+    removed.push(path);
+  }
+  const next = {
+    name: version.name,
+    version: version.version,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    files: Object.fromEntries(version.files.map((f) => [f.path, f.sha256]))
+  };
+  await writeFile(join(dest, MANIFEST_FILE), JSON.stringify(next, null, 2) + "\n", "utf8");
+  return {
+    dest,
+    version: version.version,
+    written,
+    removed,
+    keptUntracked: untracked.filter((p) => !incoming.has(p)),
+    keptEdited
+  };
+}
+function fenceFor(text3) {
+  const longest = Math.max(0, ...(text3.match(/`+/g) ?? []).map((r) => r.length));
+  return "`".repeat(Math.max(3, longest + 1));
+}
+function afterInstall(skillMd) {
+  return `No restart is needed: a running Claude Code session picks it up. If one does not list it yet, read ${skillMd} and follow it, or run /reload-skills.`;
+}
+function describeInstall(name, r) {
+  const lines = [
+    `Installed ${name} version ${r.version} into ${r.dest} (${r.written.length} file(s)).`
   ];
-  const ranked = scoreItems(scorable, taskDescription, filePaths);
-  const sections = [];
-  let overhead = 0;
-  if (stack.length > 0) {
-    const { text: text3, hidden } = selectStack(
-      stack,
-      [...extractKeywords(taskDescription), ...detectLanguages(filePaths)],
-      Math.floor(budget * STACK_SHARE)
-    );
-    const section = `## Tech Stack
-
-${text3}` + (hidden > 0 ? `
-
-_${hidden} more with \`get_tech_stack\`._` : "");
-    sections.push(section);
-    overhead += estimateTokens(section);
+  if (r.removed.length) lines.push(`Removed (no longer in the skill): ${r.removed.join(", ")}`);
+  if (r.keptEdited.length) {
+    lines.push(`Kept, edited here and no longer in the skill: ${r.keptEdited.join(", ")}`);
   }
-  if (rules.length > 0) {
-    const section = formatRules(rules);
-    sections.push(section);
-    overhead += estimateTokens(section);
+  if (r.keptUntracked.length) lines.push(`Kept, added here: ${r.keptUntracked.join(", ")}`);
+  lines.push(afterInstall(join(r.dest, "SKILL.md")));
+  return lines.join("\n");
+}
+
+// src/lib/team-setup-files.ts
+import { execFile } from "child_process";
+import { chmod, mkdir as mkdir2, readFile as readFile2, rename, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir2, userInfo } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+import { promisify } from "util";
+var SLUG_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function isWorkspace(value) {
+  return typeof value === "string" && value.length <= 64 && SLUG_RE2.test(value);
+}
+function homeDir() {
+  return homedir2();
+}
+function systemdoxDir() {
+  return join2(homeDir(), ".claude", "systemdox");
+}
+function workspaceDir(workspace) {
+  if (!isWorkspace(workspace)) throw new Error(`${JSON.stringify(workspace)} is not a workspace name`);
+  return join2(systemdoxDir(), workspace);
+}
+function statePath(workspace) {
+  return join2(workspaceDir(workspace), "state.json");
+}
+async function readJson(path, empty) {
+  let text3;
+  try {
+    text3 = await readFile2(path, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return empty;
+    throw e;
   }
-  let remaining = budget - RESERVE_TOKENS - overhead;
-  const rankedGuardrails = ranked.filter((i) => i.type === "guardrail");
-  const { selected: selectedGuardrails, tokensUsed: guardrailTokens } = selectWithinBudget(
-    rankedGuardrails,
-    Math.max(0, Math.floor(remaining * GUARDRAIL_SHARE))
-  );
-  remaining -= guardrailTokens;
-  const rankedRefs = ranked.filter(
-    (i) => i.type === "spec" || i.type === "doc"
-  );
-  const avgHeadline = rankedRefs.length ? Math.ceil(
-    rankedRefs.slice(0, MAX_HYDRATED).reduce((sum, i) => sum + i.tokenEstimate, 0) / Math.min(rankedRefs.length, MAX_HYDRATED)
-  ) : 0;
-  const affordable = Math.floor(
-    Math.max(0, remaining) / (MIN_BODY_TOKENS + avgHeadline)
-  );
-  const shortlist = rankedRefs.slice(
-    0,
-    Math.max(0, Math.min(MAX_HYDRATED, affordable))
-  );
-  for (const item of shortlist) {
-    remaining -= item.tokenEstimate;
+  try {
+    return JSON.parse(text3);
+  } catch {
+    throw new Error(`${path} is not valid JSON: fix or remove it, then run this again`);
   }
-  remaining = Math.max(0, remaining);
-  const hydrated = await Promise.all(
-    shortlist.map(
-      (item) => hydrate(api, item, refs.get(key(item.type, item.id)))
-    )
-  );
-  const tailCandidates = rankedRefs.slice(shortlist.length, shortlist.length + MAX_TAIL).map((i) => refs.get(key(i.type, i.id)));
-  const tailCost = tailCandidates.reduce(
-    (sum, m) => sum + estimateTokens(m.listLine),
-    0
-  );
-  const tailReserve = Math.min(
-    tailCost,
-    Math.floor(remaining * TAIL_SHARE)
-  );
-  const bodyBudgetStart = Math.max(0, remaining - tailReserve);
-  let bodyBudget = bodyBudgetStart;
-  let itemsLeft = hydrated.length;
-  let itemsWithBody = 0;
-  let bodyFailures = 0;
-  const blocks = [];
-  for (const h of hydrated) {
-    itemsLeft--;
-    const headline = h.meta.pointer ? `${h.item.content}
-${h.meta.pointer}` : h.item.content;
-    const emit = (block) => {
-      bodyBudget -= Math.max(
-        0,
-        estimateTokens(block) - h.item.tokenEstimate
-      );
-      blocks.push(block);
-    };
-    if (h.error !== void 0) {
-      bodyFailures++;
-      emit(
-        `${headline}
+}
+async function writeJsonAtomically(path, value, mode) {
+  await mkdir2(dirname2(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.tmp`;
+  await writeFile2(tmp, JSON.stringify(value, null, 2) + "\n", mode === void 0 ? "utf8" : { encoding: "utf8", mode });
+  await rename(tmp, path);
+}
+var run = promisify(execFile);
+async function readState(workspace) {
+  return readJson(statePath(workspace), {});
+}
+async function writeState(workspace, state) {
+  await writeJsonAtomically(statePath(workspace), state);
+}
+async function updateState(workspace, change) {
+  const state = await readState(workspace);
+  change(state);
+  await writeState(workspace, state);
+  return state;
+}
 
-_Body unavailable (${h.error}) \u2014 retry with \`${h.meta.fetchHint}\`._`
-      );
+// src/lib/session-brief.ts
+var INSTRUCTIONS_MAX = 2e3;
+var BRIEF_TIMEOUT_MS = 8e3;
+var SETUP_COMMAND = "npx -y @systemdox/mcp-server setup";
+var REFUSED = `SystemDox refused this computer's key, so the team's rules and skills cannot be read and every SystemDox tool fails. Tell the person once: a new key comes from the SystemDox console, Settings \u203A API keys, and \`${SETUP_COMMAND}\` in their own terminal stores it.`;
+var NOT_CHECKED = "SystemDox could not be read when this session started, so the team's skills were not checked. Call get_team_setup to check again before relying on them.";
+var CANNOT_SEE = "This server cannot see this computer's disk. For each skill listed under Team skills: if ~/.claude/skills/<name>/ is absent, or its .systemdox-skill.json names another version than get_team_setup lists, call install_skill with that version and write what it returns, unless the latest team plugin carries it. Leave a folder with no such file alone. If a file there differs from the hash that file holds for it, it was edited: ask the person before replacing it.";
+function noKey(reason) {
+  return `This computer has no SystemDox key it can use (${reason}), so the team's rules and skills cannot be read and every SystemDox tool fails. Tell the person once: \`${SETUP_COMMAND}\` in their own terminal asks for one.`;
+}
+function olderApi(setup) {
+  return `SystemDox workspace ${setup.workspace}. Before writing code in one of its repositories, call get_context with the task and the files you expect to touch, and obey what it returns. get_team_setup lists the team setup.`;
+}
+async function readJsonQuietly(path) {
+  try {
+    return JSON.parse(await readFile3(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function computerState(setup) {
+  const id = `${setup.workspace}-setup@systemdox-${setup.workspace}`;
+  const installed = await readJsonQuietly(join3(homeDir(), ".claude", "plugins", "installed_plugins.json"));
+  const entries2 = installed?.plugins?.[id];
+  const entry = Array.isArray(entries2) ? entries2.find((e) => (e?.scope ?? "user") === "user") : void 0;
+  const state = {
+    missing: [],
+    behind: [],
+    notFromSystemDox: [],
+    pluginInstalled: !!entry,
+    pluginVersion: entry?.version
+  };
+  const pluginCurrent = !!entry && !!setup.plugin && entry.version === `${setup.plugin.version}.0.0`;
+  for (const skill of setup.sessionBrief?.skills ?? []) {
+    const dir = defaultSkillDir(skill.name);
+    if (!existsSync2(dir)) {
+      if (!(pluginCurrent && setup.plugin?.skills?.[skill.name] !== void 0)) state.missing.push(skill.name);
       continue;
     }
-    const available = Math.max(0, bodyBudget);
-    const allowance = Math.min(
-      Math.max(MIN_BODY_TOKENS, Math.floor(available / (itemsLeft + 1))),
-      available
-    );
-    if (allowance < MIN_BODY_TOKENS) {
-      emit(
-        `${headline}
-
-_Body omitted (token budget exhausted) \u2014 fetch with \`${h.meta.fetchHint}\`._`
-      );
-      continue;
+    const manifest = await readJsonQuietly(join3(dir, MANIFEST_FILE));
+    if (typeof manifest?.version !== "number" || !Number.isInteger(manifest.version)) {
+      state.notFromSystemDox.push(skill.name);
+    } else if (manifest.version !== skill.latestVersion) {
+      state.behind.push({ name: skill.name, here: manifest.version, latest: skill.latestVersion });
     }
-    const { text: body2, truncated } = truncateToTokens(
-      h.body,
-      allowance - TRUNCATION_NOTICE_TOKENS
-    );
-    itemsWithBody++;
-    emit(
-      `${headline}
-
-${body2}` + (truncated ? `
-
-_[truncated to fit the token budget \u2014 full text via \`${h.meta.fetchHint}\`]_` : "")
-    );
   }
-  remaining = Math.max(0, remaining - (bodyBudgetStart - bodyBudget));
-  if (selectedGuardrails.length > 0) {
-    sections.push(
-      `## Checks (${selectedGuardrails.length})
-
-` + selectedGuardrails.map((i) => i.content).join("\n\n---\n\n")
-    );
+  return state;
+}
+function hasPersonParts(setup) {
+  return Object.keys(setup.parts ?? {}).length > 0 || (setup.memory ?? []).length > 0 || (setup.sessionBrief?.heldSkills ?? []).some((h) => h.reason === "not-plain");
+}
+var MORE = (n) => `${n} more (get_team_setup lists them)`;
+var LIST_MIN = `all ${MORE(100)}`.length;
+function listWithin(items, room) {
+  const whole2 = items.join(", ");
+  if (whole2.length <= room) return whole2;
+  const kept = [];
+  let used = 0;
+  for (let i = 0; i < items.length; i++) {
+    const rest = items.length - i - 1;
+    const cost = items[i].length + (kept.length ? 2 : 0);
+    if (used + cost + ` and ${MORE(rest)}`.length > room) break;
+    kept.push(items[i]);
+    used += cost;
+  }
+  return kept.length ? `${kept.join(", ")} and ${MORE(items.length - kept.length)}` : `all ${MORE(items.length)}`;
+}
+function localSection(setup, state, room) {
+  const rest = hasPersonParts(setup) ? ` and that \`${SETUP_COMMAND}\` in their own terminal adds the rest of the team setup` : "";
+  const latest = new Map((setup.sessionBrief?.skills ?? []).map((s) => [s.name, s.latestVersion]));
+  const lines = [];
+  if (state.missing.length) {
+    lines.push({
+      head: "On this computer, missing: ",
+      items: state.missing.map((name) => `${name} version ${latest.get(name)}`),
+      tail: `. Install each now with install_skill at that version, before your first answer. Then tell the person what you installed${rest}. When a skill's line matches the request and it is not loaded yet, read ~/.claude/skills/<name>/SKILL.md and follow it.`
+    });
   }
-  if (blocks.length > 0) {
-    sections.push(
-      `## Relevant Specs & Docs (${blocks.length})
-
-_Highest-ranked items \u2014 docs are scoped to their most relevant section. Each carries the ID / \`chunk_id\` to fetch more._
-
-` + blocks.join("\n\n---\n\n")
-    );
+  if (state.behind.length) {
+    lines.push({
+      head: "On this computer, behind: ",
+      items: state.behind.map((b) => `${b.name} (version ${b.here} here, latest ${b.latest})`),
+      tail: ". install_skill updates each to that latest version; if it refuses because files were edited, tell the person and leave them."
+    });
   }
-  const tailLines = [];
-  for (const meta of tailCandidates) {
-    const cost = estimateTokens(meta.listLine);
-    const named = blocks.length + tailLines.length;
-    if (cost > remaining && named >= MIN_REFERENCES) break;
-    tailLines.push(meta.listLine);
-    remaining = Math.max(0, remaining - cost);
+  if (state.notFromSystemDox.length) {
+    lines.push({ head: "Not from SystemDox, left alone: ", items: state.notFromSystemDox, tail: "." });
   }
-  if (tailLines.length > 0) {
-    sections.push(
-      `## Also Indexed (${tailLines.length})
-
-_Ranked lower \u2014 fetch with \`get_specs\` / \`get_docs\` if you need them._
+  const fixed = () => lines.reduce((n, l) => n + l.head.length + l.tail.length + LIST_MIN, 0) + Math.max(0, lines.length - 1);
+  while (lines.length && fixed() > room) lines.pop();
+  if (!lines.length) return "";
+  const share = Math.floor((room - fixed()) / lines.length) + LIST_MIN;
+  return lines.map((l) => `${l.head}${listWithin(l.items, share)}${l.tail}`).join("\n");
+}
+function fit(text3, section) {
+  const whole2 = section ? `${text3}
 
-` + tailLines.join("\n")
-    );
-  }
-  const itemsListed = blocks.length - itemsWithBody + tailLines.length;
-  const itemsOmitted = ranked.length - selectedGuardrails.length - blocks.length - tailLines.length;
-  const body = sections.join("\n\n");
-  const tokensUsed = estimateTokens(body);
-  const stats = {
-    budget,
-    tokensUsed,
-    itemsWithBody,
-    bodyFailures,
-    itemsListed,
-    itemsOmitted: Math.max(0, itemsOmitted),
-    guardrails: selectedGuardrails.length
-  };
-  if (sections.length === 0) {
-    const text3 = failures.length ? `No context found for this task, but ${failures.length} of 5 reads failed, so this is not an all-clear: the team's rules may not have been read.` : "No relevant context found for this task.";
-    return { text: text3, stats };
+${section}` : text3;
+  if (whole2.length <= INSTRUCTIONS_MAX) return whole2;
+  return text3.length <= INSTRUCTIONS_MAX ? text3 : `${text3.slice(0, INSTRUCTIONS_MAX - 1)}\u2026`;
+}
+async function readTeamSetup(apiClient, { keyProblem, timeoutMs = BRIEF_TIMEOUT_MS } = {}) {
+  if (keyProblem) return { problem: noKey(keyProblem) };
+  try {
+    const setup = await apiClient.getOwnTeamSetup(AbortSignal.timeout(timeoutMs));
+    return typeof setup?.workspace === "string" ? { setup } : { problem: NOT_CHECKED };
+  } catch (err) {
+    const status = err?.status;
+    return { problem: status === 401 || status === 403 ? REFUSED : NOT_CHECKED };
   }
-  const footer = `
-
----
-_Context: ${itemsWithBody} full text, ${itemsListed} listed, ${stats.itemsOmitted} omitted \xB7 ~${tokensUsed} of ${budget} tokens` + (bodyFailures > 0 ? ` \xB7 ${bodyFailures} body fetch(es) failed` : "") + (failures.length > 0 ? ` \xB7 ${failures.length} of 5 reads failed` : "") + `_`;
-  return { text: body + footer, stats };
 }
-
-// src/tools/get-context.ts
-function registerGetContext(server, apiClient) {
-  server.registerTool(
-    "get_context",
-    {
-      title: "Get Context",
-      description: "Intelligent context aggregator: fetches checks, specs, docs, and tech stack, ranks them by relevance to your current task, and returns the full text of the highest-ranked items within a token budget \u2014 each with the ID needed to fetch the rest. Use this instead of calling individual tools when you want curated, relevant context.",
-      inputSchema: {
-        task_description: z7.string().describe(
-          "What you're working on (e.g., 'add a new REST endpoint for user preferences')"
-        ),
-        file_paths: z7.array(z7.string()).optional().describe(
-          "File paths being edited \u2014 used for language/category detection"
-        ),
-        max_tokens: z7.number().optional().describe("Maximum token budget for the response (default: 4000)")
-      }
-    },
-    async ({ task_description, file_paths, max_tokens }) => {
-      const { text: text3 } = await buildContext(apiClient, {
-        taskDescription: task_description,
-        filePaths: file_paths,
-        maxTokens: max_tokens
-      });
-      return {
-        content: [{ type: "text", text: text3 }]
-      };
-    }
-  );
+async function sessionInstructions(apiClient, options = {}) {
+  const read = await readTeamSetup(apiClient, options);
+  if ("problem" in read) return read.problem;
+  const text3 = read.setup.sessionBrief?.text ?? olderApi(read.setup);
+  try {
+    if (!options.localFiles) return fit(text3, read.setup.sessionBrief?.skills?.length ? CANNOT_SEE : "");
+    const room = INSTRUCTIONS_MAX - text3.length - 2;
+    return fit(text3, localSection(read.setup, await computerState(read.setup), room));
+  } catch {
+    return fit(text3, "");
+  }
 }
 
 // src/tools/get-team-setup.ts
@@ -2527,7 +2517,8 @@ function registerUpdateSpec(server, apiClient) {
       }
     },
     async ({ draft_id, section, content, requirement_name }) => {
-      const spec = await apiClient.get(`/v1/specs/${draft_id}`);
+      const specPath = `/v1/specs/${encodeURIComponent(draft_id)}`;
+      const spec = await apiClient.get(specPath);
       if (spec.status !== "draft") {
         return {
           content: [
@@ -2552,8 +2543,8 @@ function registerUpdateSpec(server, apiClient) {
         };
         body.requirements = [...existing, newReq];
       }
-      await apiClient.put(`/v1/specs/${draft_id}`, body);
-      apiClient.invalidateCache(`/v1/specs/${draft_id}`);
+      await apiClient.put(specPath, body);
+      apiClient.invalidateCache(specPath);
       apiClient.invalidateCache("/v1/specs");
       return {
         content: [
@@ -2612,7 +2603,7 @@ ${decision}
 ## Consequences
 
 ${consequences}` + relatedSection;
-      await apiClient.put(`/v1/specs/${created.draftId}`, {
+      await apiClient.put(`/v1/specs/${encodeURIComponent(created.draftId)}`, {
         proposalContent: adrContent
       });
       apiClient.invalidateCache("/v1/specs");
@@ -3994,15 +3985,56 @@ function registerTeamSetupTools(server, apiClient, { localFiles }) {
 }
 
 // src/server.ts
-var SERVER_VERSION = true ? "0.1.54" : "0.0.0-dev";
-function createServer(apiClient, { localFiles = false, instructions, keyProblem } = {}) {
-  const server = new McpServer(
+var SERVER_VERSION = true ? "0.1.56" : "0.0.0-dev";
+var READ_TOOLS = [
+  "get_context",
+  "get_checks",
+  "get_guardrails",
+  "get_project_rules",
+  "get_prompt_templates",
+  "get_specs",
+  "get_docs",
+  "get_tech_stack",
+  "get_planning_context",
+  "get_plan_board",
+  "get_change",
+  "get_team_setup",
+  "get_document_links",
+  "trace_document_path",
+  "get_graph_stats",
+  "list_skills",
+  "install_skill",
+  "resolve_person"
+];
+var WRITE_TOOLS = [
+  "create_check",
+  "create_guardrail",
+  "create_project_rule",
+  "create_prompt_template",
+  "update_spec",
+  "report_decision",
+  "publish_skill",
+  "publish_setup_part"
+];
+function offering(server, access) {
+  const offered = new Set(access === "write" ? [...READ_TOOLS, ...WRITE_TOOLS] : READ_TOOLS);
+  return new Proxy(server, {
+    get(target, property) {
+      const value = Reflect.get(target, property, target);
+      if (property !== "registerTool") return typeof value === "function" ? value.bind(target) : value;
+      return (name, ...rest) => offered.has(name) ? target.registerTool(name, ...rest) : void 0;
+    }
+  });
+}
+function createServer(apiClient, { localFiles = false, instructions, keyProblem, access } = {}) {
+  const mcpServer = new McpServer(
     {
       name: "systemdox-mcp-server",
       version: SERVER_VERSION
     },
     instructions ? { instructions } : void 0
   );
+  const server = access ? offering(mcpServer, access) : mcpServer;
   registerGetGuardrails(server, apiClient);
   registerGetSpecs(server, apiClient);
   registerGetDocs(server, apiClient);
@@ -4022,7 +4054,87 @@ function createServer(apiClient, { localFiles = false, instructions, keyProblem
   registerCreatePromptTemplate(server, apiClient);
   registerSkillTools(server, apiClient, { localFiles });
   registerTeamSetupTools(server, apiClient, { localFiles });
-  return server;
+  return mcpServer;
+}
+
+// src/lib/mcp-answer.ts
+function opensSession(rawBody) {
+  try {
+    const parsed = JSON.parse(rawBody);
+    return (Array.isArray(parsed) ? parsed : [parsed]).some((m) => m?.method === "initialize");
+  } catch {
+    return false;
+  }
+}
+async function answerMcpRequest(apiClient, request, options = {}) {
+  const { url, rawBody } = request;
+  const headers = { ...request.headers };
+  const instructions = opensSession(rawBody) ? await sessionInstructions(apiClient) : void 0;
+  const server = createServer(apiClient, { instructions, ...options });
+  const transport = new WebStandardStreamableHTTPServerTransport({
+    sessionIdGenerator: void 0,
+    // stateless — every POST is independent
+    enableJsonResponse: true
+  });
+  headers["accept"] = "application/json, text/event-stream";
+  if (!(headers["content-type"] ?? "").includes("application/json")) {
+    headers["content-type"] = "application/json";
+  }
+  try {
+    await server.connect(transport);
+    const response = await transport.handleRequest(new Request(url, { method: "POST", headers, body: rawBody }));
+    const FORWARD = /* @__PURE__ */ new Set(["content-type", "mcp-session-id"]);
+    const responseHeaders = {};
+    response.headers.forEach((value, key) => {
+      if (FORWARD.has(key.toLowerCase())) responseHeaders[key] = value;
+    });
+    if (!("content-type" in responseHeaders)) {
+      responseHeaders["content-type"] = "application/json";
+    }
+    return {
+      statusCode: response.status,
+      headers: responseHeaders,
+      body: await response.text()
+    };
+  } finally {
+    void transport.close().catch((err) => console.error("MCP transport close failed:", err));
+    void server.close().catch((err) => console.error("MCP server close failed:", err));
+  }
+}
+
+// src/lib/metrics.ts
+var NAMESPACE = "SystemDox/Mcp";
+var METRIC_NAME = "McpToolCall";
+function buildMcpToolCallMetric(tenant, tool, timestamp = Date.now()) {
+  return {
+    _aws: {
+      Timestamp: timestamp,
+      CloudWatchMetrics: [
+        {
+          Namespace: NAMESPACE,
+          Dimensions: [["tenant"]],
+          Metrics: [{ Name: METRIC_NAME, Unit: "Count" }]
+        }
+      ]
+    },
+    tenant,
+    tool,
+    [METRIC_NAME]: 1
+  };
+}
+function emitMcpToolCalls(tenant, rawBody, log = console.log) {
+  try {
+    const parsed = JSON.parse(rawBody);
+    const messages = Array.isArray(parsed) ? parsed : [parsed];
+    for (const message of messages) {
+      if (typeof message === "object" && message !== null && message.method === "tools/call") {
+        const params = message.params;
+        const tool = typeof params?.name === "string" ? params.name : "unknown";
+        log(JSON.stringify(buildMcpToolCallMetric(tenant || "unknown", tool)));
+      }
+    }
+  } catch {
+  }
 }
 
 // src/http.ts
@@ -4034,14 +4146,6 @@ function lowercaseHeaders(headers) {
   }
   return out;
 }
-function opensSession(rawBody) {
-  try {
-    const parsed = JSON.parse(rawBody);
-    return (Array.isArray(parsed) ? parsed : [parsed]).some((m) => m?.method === "initialize");
-  } catch {
-    return false;
-  }
-}
 function jsonError(statusCode, message) {
   return {
     statusCode,
@@ -4095,42 +4199,11 @@ async function handler(event) {
     // per-request client; never cache across invocations
     defaultOrg: void 0
   });
-  const instructions = opensSession(rawBody) ? await sessionInstructions(apiClient) : void 0;
-  const server = createServer(apiClient, { instructions });
-  const transport = new WebStandardStreamableHTTPServerTransport({
-    sessionIdGenerator: void 0,
-    // stateless — every POST is independent
-    enableJsonResponse: true
+  return answerMcpRequest(apiClient, {
+    url: `https://${host || "localhost"}${event.path || "/mcp"}`,
+    headers,
+    rawBody
   });
-  headers["accept"] = "application/json, text/event-stream";
-  if (!(headers["content-type"] ?? "").includes("application/json")) {
-    headers["content-type"] = "application/json";
-  }
-  try {
-    await server.connect(transport);
-    const request = new Request(`https://${host || "localhost"}${event.path || "/mcp"}`, {
-      method: "POST",
-      headers,
-      body: rawBody
-    });
-    const response = await transport.handleRequest(request);
-    const FORWARD = /* @__PURE__ */ new Set(["content-type", "mcp-session-id"]);
-    const responseHeaders = {};
-    response.headers.forEach((value, key) => {
-      if (FORWARD.has(key.toLowerCase())) responseHeaders[key] = value;
-    });
-    if (!("content-type" in responseHeaders)) {
-      responseHeaders["content-type"] = "application/json";
-    }
-    return {
-      statusCode: response.status,
-      headers: responseHeaders,
-      body: await response.text()
-    };
-  } finally {
-    void transport.close().catch((err) => console.error("MCP transport close failed:", err));
-    void server.close().catch((err) => console.error("MCP server close failed:", err));
-  }
 }
 export {
   handler