@voiden/runner 2.3.0-beta.1 → 2.3.0-beta.2

package/dist/headlessContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"headlessContext.d.ts","sourceRoot":"","sources":["../src/headlessContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,KAAK,EAAE,aAAa,EAA+C,MAAM,oBAAoB,CAAA;AAEpG,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,OAAe,GACvB,aAAa,CAmFf"}
+{"version":3,"file":"headlessContext.d.ts","sourceRoot":"","sources":["../src/headlessContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAUH,OAAO,KAAK,EAAE,aAAa,EAA+C,MAAM,oBAAoB,CAAA;AAEpG,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,OAAe,GACvB,aAAa,CAoHf"}

package/dist/headlessContext.js

@@ -16,6 +16,10 @@
 import { hookRegistry, requestOrchestrator, executeWebSocket, executeGrpc } from '@voiden/executors';
 import { registerBlockSchema } from './blockSchemaRegistry.js';
 import { registerRequestContainer as registerContainerDef } from './requestContainerRegistry.js';
+import { registerToolProvider as registerToolProviderFn } from './toolRegistry.js';
+import { registerMcpToolCapabilityProvider as registerMcpToolCapabilityProviderFn } from './mcpToolCapability.js';
+import { collectVoidFiles } from './discovery.js';
+import { runVoidFile, getRequestPreview } from './runner.js';
 export function createHeadlessPluginContext(extensionId, verbose = false) {
     return {
         // ── Pipeline hook registration (for hook plugins: scripting, auth, etc.) ─
@@ -61,6 +65,20 @@ export function createHeadlessPluginContext(extensionId, verbose = false) {
         },
         // ── Verbosity ────────────────────────────────────────────────────────
         verbose,
+        // ── Runner primitives (for the plugin owning the /tool block) ─────────
+        // A plugin's runner bundle can't `import` from @voiden/runner itself —
+        // it's the host loading the plugin, not an externalized dependency, and
+        // the standalone-installed plugin copy has no node_modules to resolve it
+        // from anyway. So the handful of core-internal functions the /tool
+        // capability's relocated discover/verify/serve logic needs are handed
+        // over as already-bound closures here instead, the same way
+        // `protocols.executeWebSocket` already exposes a core-internal
+        // implementation to socket plugins without them importing it.
+        runnerPrimitives: {
+            collectVoidFiles: (inputPath) => collectVoidFiles(inputPath),
+            runVoidFile: (filePath, options) => runVoidFile(filePath, options),
+            getRequestPreview: (blocks) => getRequestPreview(blocks),
+        },
         // ── Reporting ────────────────────────────────────────────────────────
         report: {
             add: (_entry) => {
@@ -88,6 +106,22 @@ export function createHeadlessPluginContext(extensionId, verbose = false) {
             registerRequestContainer: (def) => {
                 registerContainerDef(def);
             },
+            // Host capability not yet in the published @voiden/sdk RunnerContext
+            // type, same treatment as registerRequestContainer above — lets the
+            // plugin owning the /tool block declare its own block→tool-declaration
+            // extraction function, so voiden-runner's tool discovery/verification
+            // works without hardcoding knowledge of that block's shape.
+            registerToolProvider: (extractFn) => {
+                registerToolProviderFn(extractFn);
+            },
+            // Host capability not yet in the published @voiden/sdk RunnerContext
+            // type, same treatment as registerToolProvider above — lets the plugin
+            // owning the /tool block hand back its discover/validate/verify/serve
+            // implementation (mcpToolCapability.ts's McpToolCapabilityProvider),
+            // so voiden-runner core never hardcodes that block's own semantics.
+            registerMcpToolCapabilityProvider: (p) => {
+                registerMcpToolCapabilityProviderFn(p);
+            },
         },
     };
 }

package/dist/headlessContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"headlessContext.js","sourceRoot":"","sources":["../src/headlessContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAiB,mBAAmB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEnH,OAAO,EAAE,mBAAmB,EAAuB,MAAM,0BAA0B,CAAA;AACnF,OAAO,EAAE,wBAAwB,IAAI,oBAAoB,EAA4B,MAAM,+BAA+B,CAAA;AAG1H,MAAM,UAAU,2BAA2B,CACzC,WAAmB,EACnB,UAAmB,KAAK;IAExB,OAAO;QACL,4EAA4E;QAC5E,QAAQ,EAAE;YACR,YAAY,EAAE,CAAC,KAAa,EAAE,OAAY,EAAE,QAAiB,EAAE,EAAE;gBAC/D,YAAY,CAAC,YAAY,CAAC,WAAW,EAAE,KAAsB,EAAE,OAAO,EAAE,QAAQ,IAAI,GAAG,CAAC,CAAA;YAC1F,CAAC;SACF;QAED,iFAAiF;QACjF,yEAAyE;QACzE,kEAAkE;QAClE,8EAA8E;QAC9E,cAAc,EAAE,CAAC,OAA6B,EAAE,EAAE;YAChD,mBAAmB,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,IAAI,EAAE,CAAA;gBAC9C,OAAO,CAAC,MAAM,OAAO,CAAC,OAAc,EAAE,MAAM,CAAC,CAAC,IAAI,OAAO,CAAA;YAC3D,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,kEAAkE;QAClE,yEAAyE;QACzE,sBAAsB,EAAE,CAAC,EAAuD,EAAE,EAAE;YAClF,mBAAmB,CAAC,cAAc,CAAC,KAAK,EAAE,OAAY,EAAE,MAA0B,EAAE,EAAE;gBACpF,MAAM,MAAM,GAAU,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,IAAI,EAAE,CAAA;gBACrD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;gBAC9B,OAAO,KAAK,IAAI,OAAO,CAAA;YACzB,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,0EAA0E;QAC1E,iBAAiB,EAAE,CAAC,OAA8B,EAAE,EAAE;YACpD,mBAAmB,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;gBACxE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,IAAI,EAAE,CAAA;gBAC9C,MAAM,OAAO,CAAC,QAAe,EAAE,MAAM,EAAE,OAAc,CAAC,CAAA;YACxD,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,kFAAkF;QAClF,mBAAmB,EAAE,CAAC,GAAmB,EAAE,EAAE;YAC3C,mBAAmB,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QAED,yEAAyE;QACzE,SAAS,EAAE;YACT,gBAAgB,EAAE,CAAC,GAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC;YACrD,WAAW,EAAO,CAAC,GAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;SACjD;QAED,wEAAwE;QACxE,OAAO;QAEP,wEAAwE;QACxE,MAAM,EAAE;YACN,GAAG,EAAE,CAAC,MAAW,EAAE,EAAE;gBACnB,8EAA8E;gBAC9E,iEAAiE;YACnE,CAAC;YACD,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE;SACrB;QAED,wEAAwE;QACxE,GAAI;YACF,uBAAuB,EAAM,GAAG,EAAE,GAAE,CAAC;YACrC,2BAA2B,EAAE,GAAG,EAAE,GAAE,CAAC;YACrC,yBAAyB,EAAI,GAAG,EAAE,GAAE,CAAC;YACrC,wBAAwB,EAAK,GAAG,EAAE,GAAE,CAAC;YACrC,kBAAkB,EAAW,GAAG,EAAE,GAAE,CAAC;YACrC,mBAAmB,EAAU,GAAG,EAAE,GAAE,CAAC;YACrC,aAAa,EAAgB,GAAG,EAAE,GAAE,CAAC;YACrC,KAAK,EAAE,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE;YACvC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE;YAE/B,qEAAqE;YACrE,mEAAmE;YACnE,uEAAuE;YACvE,2EAA2E;YAC3E,oEAAoE;YACpE,wBAAwB,EAAE,CAAC,GAAwB,EAAE,EAAE;gBACrD,oBAAoB,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;SACM;KACV,CAAA;AACH,CAAC"}
+{"version":3,"file":"headlessContext.js","sourceRoot":"","sources":["../src/headlessContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAiB,mBAAmB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEnH,OAAO,EAAE,mBAAmB,EAAuB,MAAM,0BAA0B,CAAA;AACnF,OAAO,EAAE,wBAAwB,IAAI,oBAAoB,EAA4B,MAAM,+BAA+B,CAAA;AAC1H,OAAO,EAAE,oBAAoB,IAAI,sBAAsB,EAAsB,MAAM,mBAAmB,CAAA;AACtG,OAAO,EAAE,iCAAiC,IAAI,mCAAmC,EAAkC,MAAM,wBAAwB,CAAA;AACjJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAmB,MAAM,aAAa,CAAA;AAG7E,MAAM,UAAU,2BAA2B,CACzC,WAAmB,EACnB,UAAmB,KAAK;IAExB,OAAO;QACL,4EAA4E;QAC5E,QAAQ,EAAE;YACR,YAAY,EAAE,CAAC,KAAa,EAAE,OAAY,EAAE,QAAiB,EAAE,EAAE;gBAC/D,YAAY,CAAC,YAAY,CAAC,WAAW,EAAE,KAAsB,EAAE,OAAO,EAAE,QAAQ,IAAI,GAAG,CAAC,CAAA;YAC1F,CAAC;SACF;QAED,iFAAiF;QACjF,yEAAyE;QACzE,kEAAkE;QAClE,8EAA8E;QAC9E,cAAc,EAAE,CAAC,OAA6B,EAAE,EAAE;YAChD,mBAAmB,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,IAAI,EAAE,CAAA;gBAC9C,OAAO,CAAC,MAAM,OAAO,CAAC,OAAc,EAAE,MAAM,CAAC,CAAC,IAAI,OAAO,CAAA;YAC3D,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,kEAAkE;QAClE,yEAAyE;QACzE,sBAAsB,EAAE,CAAC,EAAuD,EAAE,EAAE;YAClF,mBAAmB,CAAC,cAAc,CAAC,KAAK,EAAE,OAAY,EAAE,MAA0B,EAAE,EAAE;gBACpF,MAAM,MAAM,GAAU,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,IAAI,EAAE,CAAA;gBACrD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;gBAC9B,OAAO,KAAK,IAAI,OAAO,CAAA;YACzB,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,0EAA0E;QAC1E,iBAAiB,EAAE,CAAC,OAA8B,EAAE,EAAE;YACpD,mBAAmB,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;gBACxE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,IAAI,EAAE,CAAA;gBAC9C,MAAM,OAAO,CAAC,QAAe,EAAE,MAAM,EAAE,OAAc,CAAC,CAAA;YACxD,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,kFAAkF;QAClF,mBAAmB,EAAE,CAAC,GAAmB,EAAE,EAAE;YAC3C,mBAAmB,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QAED,yEAAyE;QACzE,SAAS,EAAE;YACT,gBAAgB,EAAE,CAAC,GAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC;YACrD,WAAW,EAAO,CAAC,GAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;SACjD;QAED,wEAAwE;QACxE,OAAO;QAEP,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,sEAAsE;QACtE,4DAA4D;QAC5D,+DAA+D;QAC/D,8DAA8D;QAC9D,gBAAgB,EAAE;YAChB,gBAAgB,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC;YACpE,WAAW,EAAE,CAAC,QAAgB,EAAE,OAAoB,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC;YACvF,iBAAiB,EAAE,CAAC,MAAa,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;SAChE;QAED,wEAAwE;QACxE,MAAM,EAAE;YACN,GAAG,EAAE,CAAC,MAAW,EAAE,EAAE;gBACnB,8EAA8E;gBAC9E,iEAAiE;YACnE,CAAC;YACD,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE;SACrB;QAED,wEAAwE;QACxE,GAAI;YACF,uBAAuB,EAAM,GAAG,EAAE,GAAE,CAAC;YACrC,2BAA2B,EAAE,GAAG,EAAE,GAAE,CAAC;YACrC,yBAAyB,EAAI,GAAG,EAAE,GAAE,CAAC;YACrC,wBAAwB,EAAK,GAAG,EAAE,GAAE,CAAC;YACrC,kBAAkB,EAAW,GAAG,EAAE,GAAE,CAAC;YACrC,mBAAmB,EAAU,GAAG,EAAE,GAAE,CAAC;YACrC,aAAa,EAAgB,GAAG,EAAE,GAAE,CAAC;YACrC,KAAK,EAAE,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE;YACvC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE;YAE/B,qEAAqE;YACrE,mEAAmE;YACnE,uEAAuE;YACvE,2EAA2E;YAC3E,oEAAoE;YACpE,wBAAwB,EAAE,CAAC,GAAwB,EAAE,EAAE;gBACrD,oBAAoB,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;YAED,qEAAqE;YACrE,oEAAoE;YACpE,uEAAuE;YACvE,sEAAsE;YACtE,4DAA4D;YAC5D,oBAAoB,EAAE,CAAC,SAAwB,EAAE,EAAE;gBACjD,sBAAsB,CAAC,SAAS,CAAC,CAAA;YACnC,CAAC;YAED,qEAAqE;YACrE,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,oEAAoE;YACpE,iCAAiC,EAAE,CAAC,CAA4B,EAAE,EAAE;gBAClE,mCAAmC,CAAC,CAAC,CAAC,CAAA;YACxC,CAAC;SACM;KACV,CAAA;AACH,CAAC"}

package/dist/index.js

@@ -6,6 +6,12 @@ import { fileURLToPath } from 'url';
 import chalk from 'chalk';
 import { runVoidFile } from './runner.js';
 import { resolveFiles } from './discovery.js';
+import { discoverTools, verifyTools, validateTools, upsertToolStatus, registerToolsFromDecisions, planServedTools, getCommitSha } from './mcpToolCapability.js';
+import { registerFixedTools } from './mcpServing.js';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createServer as createHttpServer } from 'node:http';
 import { loadEnabledPlugins } from './plugins/loader.js';
 import { exportToCsv } from './report/csv.js';
 import { sendMailReport } from './report/mail.js';
@@ -1342,5 +1348,248 @@ mcpCmd
     console.log(`    server registered:   ${status.codex.serverRegistered ? chalk.green('yes') : chalk.gray('no')}`);
     console.log();
 });
+mcpCmd
+    .command('serve [path]')
+    .description('Serve this project as an MCP server — the same tools @voiden/mcp-server exposes ' +
+    '(list/run/write plus declared /tool capabilities), over stdio (default) or HTTP.\n\n' +
+    '  Examples:\n' +
+    '    voiden-runner mcp serve                          # stdio, current directory\n' +
+    '    voiden-runner mcp serve ./api                     # stdio, specific project\n' +
+    '    voiden-runner mcp serve --http --port 3900         # HTTP on 127.0.0.1:3900\n' +
+    '    voiden-runner mcp serve --check                   # dry run — print what would be served, no live server\n')
+    .option('--http', 'Serve over streamable HTTP instead of stdio')
+    .option('-p, --port <port>', 'HTTP port (only with --http)', '3000')
+    .option('--host <host>', 'HTTP bind address (only with --http) — binding beyond 127.0.0.1 is a real exposure risk', '127.0.0.1')
+    .option('-e, --env <path>', 'Path to .env file for variable substitution')
+    .option('--check', 'Print what would be served and exit, without starting a live server')
+    .action(async (path, opts) => {
+    const projectRoot = resolve(path ?? '.');
+    const env = Object.fromEntries(Object.entries(process.env).filter(([, v]) => v !== undefined));
+    if (opts.env) {
+        const envPath = resolve(opts.env);
+        if (!existsSync(envPath)) {
+            console.error(chalk.red(`Env file not found: ${envPath}`));
+            process.exit(EXIT_USAGE_ERROR);
+        }
+        try {
+            Object.assign(env, loadEnvFile(envPath));
+        }
+        catch (err) {
+            console.error(chalk.red(`  ✗  ${err.message}`));
+            process.exit(EXIT_USAGE_ERROR);
+        }
+    }
+    if (opts.check) {
+        // Dry run — no live server. Same underlying decision function real
+        // serving uses, so this can never disagree with what actually gets
+        // registered.
+        const activePlugins = await loadEnabledPlugins();
+        const decisions = await planServedTools(projectRoot, env, activePlugins);
+        console.log(`\n${decisions.length} /tool block(s) found in ${projectRoot}\n`);
+        for (const d of decisions) {
+            if (d.excluded) {
+                console.log(`  [EXCLUDED] ${d.tool.name}`);
+                for (const reason of d.excludedReasons ?? [])
+                    console.log(`      ${reason}`);
+                continue;
+            }
+            const label = d.served ? (d.descriptionNote ? `SERVED (${d.status.state})` : 'SERVED') : 'WITHDRAWN';
+            console.log(`  [${label}] ${d.tool.name} — ${d.status.state}${d.status.note ? `: ${d.status.note}` : ''}`);
+        }
+        console.log(chalk.gray(`  (plus the 4 fixed tools: list_void_files, list_requests, run_request, write_result)`));
+        console.log();
+        const anyFailing = decisions.some((d) => d.excluded || d.status?.state === 'failing');
+        process.exit(anyFailing ? EXIT_RUN_FAILURE : EXIT_SUCCESS);
+    }
+    // Verification (real network calls) runs exactly once here, regardless
+    // of transport — never repeated per HTTP request below.
+    const activePlugins = await loadEnabledPlugins();
+    const decisions = await planServedTools(projectRoot, env, activePlugins);
+    const commitSha = getCommitSha(projectRoot);
+    const servedCount = decisions.filter((d) => d.served).length;
+    // Shared across calls so {{process.xxx}} runtime variables chain the
+    // same way they do for the stdio path and for @voiden/mcp-server.
+    const runtimeVars = {};
+    if (opts.http) {
+        const port = Number(opts.port);
+        const host = opts.host;
+        // A fresh McpServer + transport per HTTP request — this is how the
+        // SDK's own stateless example (examples/server/simpleStatelessStreamableHttp.js)
+        // does it, not an arbitrary choice: reusing one transport across
+        // requests returns 500s. Cheap: registration is just schema/handler
+        // wiring against the already-computed `decisions`, no re-verification.
+        const httpServer = createHttpServer(async (req, res) => {
+            try {
+                const requestServer = new McpServer({ name: 'voiden-runner', version: '1.0.0' });
+                registerFixedTools(requestServer, projectRoot, runtimeVars, activePlugins);
+                registerToolsFromDecisions(requestServer, decisions, env, runtimeVars, activePlugins, commitSha);
+                const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+                await requestServer.connect(transport);
+                res.on('close', () => {
+                    transport.close();
+                    requestServer.close();
+                });
+                await transport.handleRequest(req, res);
+            }
+            catch (err) {
+                console.error(chalk.red(`  ✗  Error handling MCP request: ${err?.message ?? String(err)}`));
+                if (!res.headersSent) {
+                    res.writeHead(500, { 'content-type': 'application/json' }).end(JSON.stringify({
+                        jsonrpc: '2.0', error: { code: -32603, message: 'Internal server error' }, id: null,
+                    }));
+                }
+            }
+        });
+        httpServer.listen(port, host, () => {
+            console.error(chalk.green(`  ✓  voiden-runner mcp serve — listening on http://${host}:${port}/mcp`));
+            console.error(chalk.gray(`     ${servedCount} tool(s) served (plus list_void_files, list_requests, run_request, write_result)`));
+            if (host !== '127.0.0.1' && host !== 'localhost') {
+                console.error(chalk.red(`  ⚠  Bound to ${host} — reachable beyond this machine. Make sure that's intended.`));
+            }
+        });
+        // No process.exit() — stays alive until Ctrl-C, same as the stdio path below.
+    }
+    else {
+        // stdio: one persistent server for the process lifetime — stdout is
+        // reserved for the JSON-RPC stream, so nothing gets printed there.
+        // Startup info goes to stderr only, same discipline @voiden/mcp-server's
+        // own entrypoint already follows (it prints nothing).
+        const server = new McpServer({ name: 'voiden-runner', version: '1.0.0' });
+        registerFixedTools(server, projectRoot, runtimeVars, activePlugins);
+        registerToolsFromDecisions(server, decisions, env, runtimeVars, activePlugins, commitSha);
+        await server.connect(new StdioServerTransport());
+    }
+});
+// ── voiden-runner tool ────────────────────────────────────────────────────────
+//
+// Discovery + verification for /tool blocks (voiden-mcp-tool plugin) — the
+// standalone CLI surface for the same discoverTools/verifyTools functions
+// @voiden/mcp-server will use for live agent-serving. No scheduling here:
+// `cadence` on a verify entry is a tag `--cadence` filters by, not something
+// this command enforces timing for — that's a human/CI decision, same as
+// deciding when to run `voiden-runner run` at all.
+const toolCmd = program
+    .command('tool')
+    .description('Discover and verify /tool blocks — capabilities declared for AI agents');
+toolCmd
+    .command('list [paths...]')
+    .description('List every /tool block found under the given path(s) (default: current directory) — does not execute anything')
+    .option('--json', 'Output as JSON')
+    .action(async (paths, opts) => {
+    const targets = paths.length > 0 ? paths : ['.'];
+    const allTools = [];
+    const activePlugins = await loadEnabledPlugins();
+    for (const p of targets) {
+        allTools.push(...await discoverTools(resolve(p), { activePlugins }));
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(allTools, null, 2));
+        return;
+    }
+    if (allTools.length === 0) {
+        console.log(chalk.yellow('  No /tool blocks found.'));
+        return;
+    }
+    console.log();
+    for (const tool of allTools) {
+        console.log(chalk.bold(`  ${tool.name}`) + chalk.gray(`  —  ${relative(process.cwd(), tool.filePath)}${tool.sectionLabel ? ` [${tool.sectionLabel}]` : ''}`));
+        if (tool.description)
+            console.log(chalk.gray(`    ${tool.description}`));
+        console.log(chalk.gray(`    params: ${tool.params.length}   verifies: ${tool.verifies.length}   on-failure: ${tool.onFailure}`));
+        console.log();
+    }
+});
+toolCmd
+    .command('verify [paths...]')
+    .description("Run each /tool block's verification requests and report verified / unverified / failing.\n\n" +
+    '  Examples:\n' +
+    '    voiden-runner tool verify\n' +
+    '    voiden-runner tool verify ./api/ --cadence nightly\n' +
+    '    voiden-runner tool verify --json --write\n')
+    .option('--cadence <tag>', 'Only run verification requests tagged with this cadence — omit to run every entry regardless of tag')
+    .option('--json', 'Output as JSON (suppresses normal output — useful for CI)')
+    .option('--write', 'Write the computed status back into each /tool block. Off by default — verification always recomputes fresh and never trusts a stale write-back')
+    .option('-e, --env <path>', 'Path to .env or .yaml file for variable substitution')
+    .action(async (paths, opts) => {
+    const targets = paths.length > 0 ? paths : ['.'];
+    const env = Object.fromEntries(Object.entries(process.env).filter(([, v]) => v !== undefined));
+    if (opts.env) {
+        const envPath = resolve(opts.env);
+        if (!existsSync(envPath)) {
+            console.error(chalk.red(`Env file not found: ${envPath}`));
+            process.exit(EXIT_USAGE_ERROR);
+        }
+        try {
+            Object.assign(env, loadEnvFile(envPath));
+        }
+        catch (err) {
+            console.error(chalk.red(`  ✗  ${err.message}`));
+            process.exit(EXIT_USAGE_ERROR);
+        }
+    }
+    const activePlugins = await loadEnabledPlugins();
+    const allTools = [];
+    for (const p of targets) {
+        allTools.push(...await discoverTools(resolve(p), { activePlugins }));
+    }
+    if (allTools.length === 0) {
+        if (opts.json)
+            console.log(JSON.stringify({ tools: [], issues: [] }, null, 2));
+        else
+            console.log(chalk.yellow('  No /tool blocks found.'));
+        process.exit(EXIT_SUCCESS);
+    }
+    const { validTools, issues } = await validateTools(resolve(targets[0]), allTools);
+    const statuses = await verifyTools(validTools, { cadence: opts.cadence, env, activePlugins });
+    if (opts.write) {
+        for (const status of statuses) {
+            try {
+                upsertToolStatus(status.tool.filePath, status.tool.toolBlockUid, { state: status.state, note: status.note });
+            }
+            catch (err) {
+                console.error(chalk.red(`  ✗  Failed to write status for "${status.tool.name}": ${err?.message ?? String(err)}`));
+            }
+        }
+    }
+    const anyFailing = statuses.some(s => s.state === 'failing') || issues.length > 0;
+    if (opts.json) {
+        console.log(JSON.stringify({ tools: statuses, issues }, null, 2));
+    }
+    else {
+        console.log();
+        // Structurally excluded tools (§1.6) — reported distinctly from a
+        // verification failure: this is "the contract itself doesn't add up,"
+        // not "the contract's proof failed." Neither ran nor counted below.
+        const excludedNames = [...new Set(issues.map(i => i.tool.name))];
+        for (const name of excludedNames) {
+            console.log(`  ${chalk.red('✗ excluded')}   ${chalk.bold(name)}`);
+            for (const issue of issues.filter(i => i.tool.name === name)) {
+                console.log(chalk.gray(`      [${issue.check}] ${issue.message}`));
+            }
+            console.log();
+        }
+        for (const status of statuses) {
+            const icon = status.state === 'verified' ? chalk.green('✓ verified  ') :
+                status.state === 'failing' ? chalk.red('✗ failing   ') :
+                    chalk.yellow('○ unverified');
+            console.log(`  ${icon}  ${chalk.bold(status.tool.name)}` + chalk.gray(`  —  ${relative(process.cwd(), status.tool.filePath)}${status.tool.sectionLabel ? ` [${status.tool.sectionLabel}]` : ''}`));
+            if (status.note)
+                console.log(chalk.gray(`      ${status.note}`));
+            for (const r of status.results) {
+                const rIcon = r.passed ? chalk.green('✓') : chalk.red('✗');
+                console.log(`      ${rIcon} ${r.entry.role}: ${r.entry.sectionLabel}` + (r.reason ? chalk.gray(`  (${r.reason})`) : ''));
+            }
+            console.log();
+        }
+        const verified = statuses.filter(s => s.state === 'verified').length;
+        const unverified = statuses.filter(s => s.state === 'unverified').length;
+        const failing = statuses.filter(s => s.state === 'failing').length;
+        console.log(chalk.bold(`  ${statuses.length} tool(s)`) + chalk.gray(` — ${chalk.green(verified + ' verified')}, ${chalk.yellow(unverified + ' unverified')}, ${chalk.red(failing + ' failing')}`) + (excludedNames.length > 0 ? chalk.red(`, ${excludedNames.length} excluded`) : ''));
+        if (opts.write)
+            console.log(chalk.gray('  Status written back into each /tool block.'));
+        console.log();
+    }
+    process.exit(anyFailing ? EXIT_RUN_FAILURE : EXIT_SUCCESS);
+});
 program.parse();
 //# sourceMappingURL=index.js.map