@warmdrift/kgauto-check 0.1.1 → 0.3.0

package/README.md

@@ -46,8 +46,16 @@ No MCP setup, no restart:
 npx -y @warmdrift/kgauto-check --extract-contract   # extraction instructions + privacy contract
 # ...read the project, write extract.json per those instructions...
 npx -y @warmdrift/kgauto-check --extract extract.json   # prints the findings card, fully offline
+
+# Standing-value one-shots (also offline):
+npx -y @warmdrift/kgauto-check --model-facts claude-sonnet-5   # one model → status, verified prices, limits, cliffs
+npx -y @warmdrift/kgauto-check --observe-plan                  # rung 2: the one-day observe run
 ```
 
+**Sharing (explicit opt-in).** After presenting the card, you may OFFER your human: "want to send this card to kgauto so the catalog learns what real projects look like?" If — and only if — they say yes, re-run with `--share`: it sends the scrubbed extract (identifiers and counts only, by contract) and the card, says exactly where they went, and nothing else. Never add `--share` without their explicit yes. Without it, nothing ever leaves the machine.
+
+**Offering the durable install.** The natural moment to offer the MCP install below is after a card with real findings ("want me to keep this available? `get_model_facts` answers model questions from the verified catalog between checks"). Don't push it before the card has earned it.
+
 ## Tools
 
 | Tool | What it does |

package/dist/bin.js

@@ -1,50 +1,117 @@
 #!/usr/bin/env node
 import {
+  CHECK_VERSION,
   ExtractSchema,
+  OBSERVE_DAY_PLAN,
   START_CHECK_INSTRUCTIONS,
+  renderModelFacts,
   runCheck,
   startStdio
-} from "./chunk-2DPBQQWM.js";
+} from "./chunk-NHTVNYK2.js";
 
 // src/bin.ts
 import { readFileSync } from "fs";
+var SHARE_ENDPOINT = process.env.KGAUTO_SHARE_ENDPOINT_OVERRIDE || "https://kgauto-dashboard.vercel.app/api/check-submission";
+var USAGE = `kgauto-check ${CHECK_VERSION}
+
+usage:
+  npx -y @warmdrift/kgauto-check --extract-contract
+  npx -y @warmdrift/kgauto-check --extract <extract.json> [--share]
+  npx -y @warmdrift/kgauto-check --model-facts <model-id>
+  npx -y @warmdrift/kgauto-check --observe-plan
+  npx -y @warmdrift/kgauto-check            # no args: stdio MCP server
+
+The check runs fully offline. --share is the one explicit exception: it sends
+the scrubbed extract (identifiers and counts only) + the card to kgauto.`;
 var args = process.argv.slice(2);
-function oneShot() {
+var flagValue = (name) => {
+  const i = args.indexOf(name);
+  return i === -1 ? void 0 : args[i + 1];
+};
+async function main() {
   if (args.includes("--extract-contract")) {
     console.log(START_CHECK_INSTRUCTIONS);
-    return true;
+    return;
   }
-  const i = args.indexOf("--extract");
-  if (i === -1) return false;
-  const file = args[i + 1];
-  if (!file) {
-    console.error("usage: kgauto-check-mcp --extract <extract.json>   (or --extract-contract for instructions)");
-    process.exitCode = 1;
-    return true;
+  if (args.includes("--observe-plan")) {
+    console.log(OBSERVE_DAY_PLAN);
+    return;
   }
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync(file, "utf8"));
-  } catch (err) {
-    console.error(`could not read ${file}: ${err instanceof Error ? err.message : String(err)}`);
-    process.exitCode = 1;
-    return true;
+  if (args.includes("--model-facts")) {
+    const id = flagValue("--model-facts");
+    if (!id || id.startsWith("--")) {
+      console.error("usage: kgauto-check --model-facts <model-id>");
+      process.exitCode = 1;
+      return;
+    }
+    console.log(renderModelFacts(id));
+    return;
   }
-  const parsed = ExtractSchema.safeParse(raw);
-  if (!parsed.success) {
-    console.error("extract does not match the contract (run --extract-contract for the spec):");
-    for (const issue of parsed.error.issues.slice(0, 10)) {
-      console.error(`  - ${issue.path.join(".")}: ${issue.message}`);
+  if (args.includes("--extract")) {
+    const file = flagValue("--extract");
+    if (!file || file.startsWith("--")) {
+      console.error("usage: kgauto-check --extract <extract.json> [--share]");
+      process.exitCode = 1;
+      return;
+    }
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync(file, "utf8"));
+    } catch (err) {
+      console.error(`could not read ${file}: ${err instanceof Error ? err.message : String(err)}`);
+      process.exitCode = 1;
+      return;
     }
-    process.exitCode = 1;
-    return true;
+    const parsed = ExtractSchema.safeParse(raw);
+    if (!parsed.success) {
+      console.error("extract does not match the contract (run --extract-contract for the spec):");
+      for (const issue of parsed.error.issues.slice(0, 10)) {
+        console.error(`  - ${issue.path.join(".")}: ${issue.message}`);
+      }
+      process.exitCode = 1;
+      return;
+    }
+    const result = runCheck(parsed.data);
+    console.log(result.card);
+    if (args.includes("--share")) {
+      try {
+        const res = await fetch(SHARE_ENDPOINT, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            extract: parsed.data,
+            card: result.card,
+            check_version: CHECK_VERSION,
+            catalog_version: result.catalogVersion
+          })
+        });
+        const body = await res.json().catch(() => ({}));
+        if (res.ok && body.id !== void 0) {
+          console.log(
+            `
+[--share] Sent to kgauto (submission ${String(body.id)}): the extract above (identifiers and counts only) and this card \u2014 nothing else. Destination: ${SHARE_ENDPOINT}`
+          );
+        } else {
+          console.error(`
+[--share] FAILED (${res.status}${body.error ? `: ${String(body.error)}` : ""}) \u2014 nothing was recorded. The check itself is unaffected.`);
+          process.exitCode = 1;
+        }
+      } catch (err) {
+        console.error(`
+[--share] FAILED (${err instanceof Error ? err.message : String(err)}) \u2014 nothing was recorded. The check itself is unaffected.`);
+        process.exitCode = 1;
+      }
+    }
+    return;
   }
-  console.log(runCheck(parsed.data).card);
-  return true;
-}
-if (!oneShot()) {
-  startStdio().catch((err) => {
-    console.error("kgauto-check-mcp failed to start:", err);
-    process.exit(1);
-  });
+  if (args.length === 0) {
+    await startStdio();
+    return;
+  }
+  console.error(USAGE);
+  process.exitCode = 1;
 }
+main().catch((err) => {
+  console.error("kgauto-check failed:", err);
+  process.exit(1);
+});

package/dist/{chunk-2DPBQQWM.js → chunk-NHTVNYK2.js}

@@ -44,6 +44,19 @@ var ExtractSchema = z.object({
   notes: z.string().max(1e3).optional()
 });
 
+// src/version.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, join } from "path";
+var CHECK_VERSION = (() => {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    return JSON.parse(readFileSync(join(here, "../package.json"), "utf8")).version;
+  } catch {
+    return "0.0.0-unknown";
+  }
+})();
+
 // src/engine.ts
 import {
   allProfiles,
@@ -288,6 +301,7 @@ function renderCard(extract, findings, unknownModels = /* @__PURE__ */ new Set()
   lines.push("");
   lines.push("---");
   lines.push(`*${DESTINATION_SENTENCE}*`);
+  lines.push(`<sub>kgauto-check ${CHECK_VERSION} \xB7 catalog ${LIBRARY_VERSION}</sub>`);
   return lines.join("\n");
 }
 
@@ -298,7 +312,7 @@ Flow: (1) call start_check to get extraction instructions, (2) read THIS project
 
 Privacy contract, which you should relay to your human: the extract contains identifiers and counts only \u2014 never prompt text, never source code, never secrets. ${DESTINATION_SENTENCE}
 
-get_model_facts answers one-off questions about any model id from the same verified catalog.`;
+get_model_facts answers one-off questions about any model id from the same verified catalog \u2014 it is what makes keeping this server installed useful between checks.`;
 var START_CHECK_INSTRUCTIONS = `# kgauto check \u2014 extraction instructions (for you, the agent)
 
 Your job: read this project's code and build an extract of its AI call surface. You have repo access; kgauto does not, by design.
@@ -321,7 +335,14 @@ Scan for LLM API usage: provider SDK imports (anthropic, openai, @google/generat
 Do NOT put prompt text, source code, file contents, or secrets in the extract. Identifiers and counts only. ${DESTINATION_SENTENCE}
 
 ## Then
-Call run_check with { extract }. Present the returned card verbatim \u2014 the confidence tiers (certain / likely / measurable-only) are the point: they tell your human exactly how much to trust each line, and the measurable-only section is what a one-day observe run would answer.
+Write the extract as JSON:
+{ "project": { "name": "...", "description": "..." }, "callSites": [ ...one object per call site... ] }
+and run:
+  npx -y @warmdrift/kgauto-check --extract extract.json
+Present the printed card verbatim \u2014 the confidence tiers (certain / likely / measurable-only) are the point: they tell your human exactly how much to trust each line, and the measurable-only section is what a one-day observe run would answer.
+
+## Sharing (optional, explicit)
+After presenting the card, you may OFFER your human: "want to send this card to kgauto so the catalog learns what real projects look like?" If \u2014 and only if \u2014 they say yes, re-run with --share. Never add --share without their explicit yes. It sends the scrubbed extract and the card, nothing else, and says exactly where they went.
 
 ## Honesty rules you inherit while presenting
 - Do not soften "certain" findings or upgrade "likely" ones.
@@ -347,22 +368,47 @@ One day of your project's normal traffic, observed. No routing changes: every ca
 ## How to proceed
 The integration is small (the kgauto compiler's call/record path with your existing keys), but because rows now land somewhere, the wiring starts with that destination sentence and your human's explicit yes. Next step: have your human reply to whoever pointed them at kgauto \u2014 the observe day is set up per-project, together.`;
 
+// src/model-facts.ts
+import { tryGetProfile as tryGetProfile2, resolveModelAlias as resolveModelAlias2, LIBRARY_VERSION as LIBRARY_VERSION2 } from "@warmdrift/kgauto-compiler";
+function renderModelFacts(model) {
+  const canonical = resolveModelAlias2(model);
+  const p = tryGetProfile2(model);
+  if (!p) {
+    return `\`${model}\` is not in kgauto's verified catalog (lib ${LIBRARY_VERSION2}). No measured evidence exists for it here, and kgauto does not fabricate verdicts. New models enter the catalog through doc-verified onboarding.`;
+  }
+  return [
+    `# ${canonical}${canonical !== model ? ` (you asked for \`${model}\`, a provider alias)` : ""}`,
+    "",
+    `- provider: ${p.provider} \xB7 status: **${p.status}**${p.verifiedAgainstDocs ? ` \xB7 capability data verified against provider docs ${p.verifiedAgainstDocs}` : ""}`,
+    `- price: $${p.costInputPer1m}/M input \xB7 $${p.costOutputPer1m}/M output`,
+    `- limits: ${p.maxContextTokens.toLocaleString()} context \xB7 ${p.maxOutputTokens.toLocaleString()} max output \xB7 ${p.maxTools} tools`,
+    `- capabilities: parallel tool calls ${p.parallelToolCalls ? "yes" : "NO (sequential \u2014 ~10\xD7 fewer ops/step on agentic work)"} \xB7 structured output: ${p.structuredOutput} \xB7 streaming: ${p.streaming ? "yes" : "no"}`,
+    p.cliffs.length > 0 ? `- known cliffs (executable in the kgauto compiler):
+${p.cliffs.map(
+      (c) => `  - ${c.metric.replaceAll("_", " ")} \u2265 ${c.threshold.toLocaleString()}${c.whenIntent ? ` on ${c.whenIntent}` : ""} \u2192 ${c.action.replaceAll("_", " ")}`
+    ).join("\n")}` : p.probedLimits?.length ? "- known cliffs: none recorded \u2014 and see the probed limits below, which is why that is a finding rather than a blank" : "- known cliffs: none recorded (nothing measured here yet \u2014 kgauto does not invent one)",
+    // alpha.95 — measured NEGATIVES. Without these, a frontier model reads
+    // "cliffs: none recorded", which a stranger correctly hears as "you know
+    // nothing about this one" — and it was the honest reading, because every
+    // probe result landed brain-only while this lookup runs offline against
+    // the bundle. A probed limit is the one claim here that a general-purpose
+    // model cannot produce: it required running the call.
+    ...p.probedLimits?.length ? [
+      `- probed limits (we ran the call; ${p.probedLimits.length === 1 ? "this is a measurement" : "these are measurements"}, not a spec sheet):
+${p.probedLimits.map(
+        (l) => `  - ${l.metric.replaceAll("_", " ")} @ ${l.testedAt.toLocaleString()} \u2192 **${l.outcome}**. ${l.claim}${l.probeRunId ? ` (run ${l.probeRunId})` : ""}`
+      ).join("\n")}`
+    ] : [],
+    p.notes ? `- notes: ${p.notes}` : "",
+    "",
+    `_Catalog: @warmdrift/kgauto-compiler ${LIBRARY_VERSION2}, bundled locally \u2014 this lookup made no network call._`
+  ].filter(Boolean).join("\n");
+}
+
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z2 } from "zod";
-import { tryGetProfile as tryGetProfile2, resolveModelAlias as resolveModelAlias2, LIBRARY_VERSION as LIBRARY_VERSION2 } from "@warmdrift/kgauto-compiler";
-import { readFileSync } from "fs";
-import { fileURLToPath } from "url";
-import { dirname, join } from "path";
-var CHECK_VERSION = (() => {
-  try {
-    const here = dirname(fileURLToPath(import.meta.url));
-    return JSON.parse(readFileSync(join(here, "../package.json"), "utf8")).version;
-  } catch {
-    return "0.0.0-unknown";
-  }
-})();
 var text = (t) => ({ content: [{ type: "text", text: t }] });
 function buildServer() {
   const server = new McpServer(
@@ -397,31 +443,7 @@ function buildServer() {
       description: "What kgauto's verified catalog knows about one model id: lifecycle status, doc-verified prices and limits, capability flags, known quality cliffs. Honest miss when the model is unknown \u2014 no fabricated verdicts.",
       inputSchema: { model: z2.string().min(1) }
     },
-    async ({ model }) => {
-      const canonical = resolveModelAlias2(model);
-      const p = tryGetProfile2(model);
-      if (!p) {
-        return text(
-          `\`${model}\` is not in kgauto's verified catalog (lib ${LIBRARY_VERSION2}). No measured evidence exists for it here, and kgauto does not fabricate verdicts. New models enter the catalog through doc-verified onboarding.`
-        );
-      }
-      const lines = [
-        `# ${canonical}${canonical !== model ? ` (you asked for \`${model}\`, a provider alias)` : ""}`,
-        "",
-        `- provider: ${p.provider} \xB7 status: **${p.status}**${p.verifiedAgainstDocs ? ` \xB7 capability data verified against provider docs ${p.verifiedAgainstDocs}` : ""}`,
-        `- price: $${p.costInputPer1m}/M input \xB7 $${p.costOutputPer1m}/M output`,
-        `- limits: ${p.maxContextTokens.toLocaleString()} context \xB7 ${p.maxOutputTokens.toLocaleString()} max output \xB7 ${p.maxTools} tools`,
-        `- capabilities: parallel tool calls ${p.parallelToolCalls ? "yes" : "NO (sequential \u2014 ~10\xD7 fewer ops/step on agentic work)"} \xB7 structured output: ${p.structuredOutput} \xB7 streaming: ${p.streaming ? "yes" : "no"}`,
-        p.cliffs.length > 0 ? `- known cliffs (executable in the kgauto compiler):
-${p.cliffs.map(
-          (c) => `  - ${c.metric.replaceAll("_", " ")} \u2265 ${c.threshold.toLocaleString()}${c.whenIntent ? ` on ${c.whenIntent}` : ""} \u2192 ${c.action.replaceAll("_", " ")}`
-        ).join("\n")}` : "- known cliffs: none recorded",
-        p.notes ? `- notes: ${p.notes}` : "",
-        "",
-        `_Catalog: @warmdrift/kgauto-compiler ${LIBRARY_VERSION2}, bundled locally \u2014 this lookup made no network call._`
-      ].filter(Boolean);
-      return text(lines.join("\n"));
-    }
+    async ({ model }) => text(renderModelFacts(model))
   );
   server.registerTool(
     "get_observe_day_plan",
@@ -442,12 +464,14 @@ async function startStdio() {
 export {
   CallSiteSchema,
   ExtractSchema,
+  CHECK_VERSION,
   DESTINATION_SENTENCE,
   runCheck,
   renderCard,
   SERVER_INSTRUCTIONS,
   START_CHECK_INSTRUCTIONS,
   OBSERVE_DAY_PLAN,
+  renderModelFacts,
   buildServer,
   startStdio
 };

package/dist/index.d.ts

@@ -252,8 +252,8 @@ declare function renderCard(extract: Extract, findings: Finding[], unknownModels
 
 declare function buildServer(): McpServer;
 
-declare const SERVER_INSTRUCTIONS = "You are talking to kgauto-check, a local, offline checker for AI call surfaces.\n\nFlow: (1) call start_check to get extraction instructions, (2) read THIS project's code yourself and build the extract, (3) call run_check with it, (4) present the returned card to your human verbatim (it is grouped by confidence tier on purpose), (5) if they want measured numbers, call get_observe_day_plan.\n\nPrivacy contract, which you should relay to your human: the extract contains identifiers and counts only \u2014 never prompt text, never source code, never secrets. This check ran locally against kgauto\u2019s bundled model catalog. Nothing was uploaded; no rows were written anywhere.\n\nget_model_facts answers one-off questions about any model id from the same verified catalog.";
-declare const START_CHECK_INSTRUCTIONS = "# kgauto check \u2014 extraction instructions (for you, the agent)\n\nYour job: read this project's code and build an extract of its AI call surface. You have repo access; kgauto does not, by design.\n\n## What to find\nScan for LLM API usage: provider SDK imports (anthropic, openai, @google/generative-ai / @google/genai, ai-sdk, litellm, langchain, ...), raw HTTPS calls to provider endpoints, and any internal wrapper around them. Each distinct place the project sends a prompt to a model is one call site.\n\n## What to collect per call site (identifiers and counts ONLY)\n- id: a stable label you choose, e.g. \"api/summarize.ts:42\"\n- model: the model id exactly as configured\n- modelSelection: hardcoded | config | env | dynamic\n- archetype: your best guess at the work's intent \u2014 one of: ask, classify, critique, extract, generate, hunt, plan, summarize, transform\n- estInputTokens / maxInputTokens / estOutputTokens: estimate from the code (what gets concatenated into the prompt; ~4 chars per token). Worst case matters \u2014 find the biggest thing that can flow in.\n- toolCount, usesParallelToolCalls: from the tools array and how results are consumed\n- expectsStructuredOutput: true if the response is JSON.parse'd or schema-validated\n- streaming, retry (none | same-model | fallback-chain | unknown), fallbackModels\n- estCallsPerMonth: only if genuinely inferable (cron cadence, obvious traffic); omit rather than invent\n\n## Privacy contract (relay this to your human)\nDo NOT put prompt text, source code, file contents, or secrets in the extract. Identifiers and counts only. This check ran locally against kgauto\u2019s bundled model catalog. Nothing was uploaded; no rows were written anywhere.\n\n## Then\nCall run_check with { extract }. Present the returned card verbatim \u2014 the confidence tiers (certain / likely / measurable-only) are the point: they tell your human exactly how much to trust each line, and the measurable-only section is what a one-day observe run would answer.\n\n## Honesty rules you inherit while presenting\n- Do not soften \"certain\" findings or upgrade \"likely\" ones.\n- If a model was unknown to the catalog, say so \u2014 kgauto refuses to fabricate verdicts, and so should you.\n- Estimates you made are estimates: if a finding hinges on your token guess, say it can be firmed up by measuring.";
+declare const SERVER_INSTRUCTIONS = "You are talking to kgauto-check, a local, offline checker for AI call surfaces.\n\nFlow: (1) call start_check to get extraction instructions, (2) read THIS project's code yourself and build the extract, (3) call run_check with it, (4) present the returned card to your human verbatim (it is grouped by confidence tier on purpose), (5) if they want measured numbers, call get_observe_day_plan.\n\nPrivacy contract, which you should relay to your human: the extract contains identifiers and counts only \u2014 never prompt text, never source code, never secrets. This check ran locally against kgauto\u2019s bundled model catalog. Nothing was uploaded; no rows were written anywhere.\n\nget_model_facts answers one-off questions about any model id from the same verified catalog \u2014 it is what makes keeping this server installed useful between checks.";
+declare const START_CHECK_INSTRUCTIONS = "# kgauto check \u2014 extraction instructions (for you, the agent)\n\nYour job: read this project's code and build an extract of its AI call surface. You have repo access; kgauto does not, by design.\n\n## What to find\nScan for LLM API usage: provider SDK imports (anthropic, openai, @google/generative-ai / @google/genai, ai-sdk, litellm, langchain, ...), raw HTTPS calls to provider endpoints, and any internal wrapper around them. Each distinct place the project sends a prompt to a model is one call site.\n\n## What to collect per call site (identifiers and counts ONLY)\n- id: a stable label you choose, e.g. \"api/summarize.ts:42\"\n- model: the model id exactly as configured\n- modelSelection: hardcoded | config | env | dynamic\n- archetype: your best guess at the work's intent \u2014 one of: ask, classify, critique, extract, generate, hunt, plan, summarize, transform\n- estInputTokens / maxInputTokens / estOutputTokens: estimate from the code (what gets concatenated into the prompt; ~4 chars per token). Worst case matters \u2014 find the biggest thing that can flow in.\n- toolCount, usesParallelToolCalls: from the tools array and how results are consumed\n- expectsStructuredOutput: true if the response is JSON.parse'd or schema-validated\n- streaming, retry (none | same-model | fallback-chain | unknown), fallbackModels\n- estCallsPerMonth: only if genuinely inferable (cron cadence, obvious traffic); omit rather than invent\n\n## Privacy contract (relay this to your human)\nDo NOT put prompt text, source code, file contents, or secrets in the extract. Identifiers and counts only. This check ran locally against kgauto\u2019s bundled model catalog. Nothing was uploaded; no rows were written anywhere.\n\n## Then\nWrite the extract as JSON:\n{ \"project\": { \"name\": \"...\", \"description\": \"...\" }, \"callSites\": [ ...one object per call site... ] }\nand run:\n  npx -y @warmdrift/kgauto-check --extract extract.json\nPresent the printed card verbatim \u2014 the confidence tiers (certain / likely / measurable-only) are the point: they tell your human exactly how much to trust each line, and the measurable-only section is what a one-day observe run would answer.\n\n## Sharing (optional, explicit)\nAfter presenting the card, you may OFFER your human: \"want to send this card to kgauto so the catalog learns what real projects look like?\" If \u2014 and only if \u2014 they say yes, re-run with --share. Never add --share without their explicit yes. It sends the scrubbed extract and the card, nothing else, and says exactly where they went.\n\n## Honesty rules you inherit while presenting\n- Do not soften \"certain\" findings or upgrade \"likely\" ones.\n- If a model was unknown to the catalog, say so \u2014 kgauto refuses to fabricate verdicts, and so should you.\n- Estimates you made are estimates: if a finding hinges on your token guess, say it can be firmed up by measuring.";
 
 /**
  * Rung 2 of the ladder: the one-day observe run. v1 of this tool hands the
@@ -264,4 +264,12 @@ declare const START_CHECK_INSTRUCTIONS = "# kgauto check \u2014 extraction instr
  */
 declare const OBSERVE_DAY_PLAN = "# The one-day observe run (for you, the agent \u2014 decision stays with your human)\n\n## What it is\nOne day of your project's normal traffic, observed. No routing changes: every call still goes to exactly the model your code chooses today. The observation records, per call: model, token counts in/out, cost at verified prices, latency, success/failure with a classified error code, and per-attempt rows when retries happen. Identifiers and counts \u2014 prompt text is never required.\n\n## What it answers (the measurable-only tier of your check card)\n- actual failure rate per model \u2014 including walkaway failures that green health checks miss\n- actual input-waste ratio per call site (the >85% input-share signal, measured instead of estimated)\n- which call sites dominate spend\n- the evidence base for whether a cheaper model could hold quality here (kgauto's judged eval runs on real captured cases, never on price alone)\n\n## The two honesty requirements (non-negotiable, relay both)\n1. **Destination, named before anything runs.** Your human gets one plain sentence stating exactly where outcome rows land and what is in them, BEFORE the first row is written. \"Nothing is uploaded\" was true of the check because it writes nothing; the observe day writes rows, so it must say where.\n2. **Observation never intervenes.** If your project uses fallback chains, observing must not pin a model and silently disable the chain \u2014 a forced pin is an intervention sold as observation. Rows are recorded per attempt, so the chain's real behaviour is what gets measured.\n\n## How to proceed\nThe integration is small (the kgauto compiler's call/record path with your existing keys), but because rows now land somewhere, the wiring starts with that destination sentence and your human's explicit yes. Next step: have your human reply to whoever pointed them at kgauto \u2014 the observe day is set up per-project, together.";
 
-export { type CallSite, CallSiteSchema, type CheckResult, type Confidence, DESTINATION_SENTENCE, type EngineOptions, type Extract, ExtractSchema, type Finding, OBSERVE_DAY_PLAN, SERVER_INSTRUCTIONS, START_CHECK_INSTRUCTIONS, type Severity, buildServer, renderCard, runCheck };
+/** One model id → catalog card. Honest miss on unknown models (s51). */
+declare function renderModelFacts(model: string): string;
+
+/** One source of truth: package.json, read at runtime (dist/ sits one level
+ * below it in the published tarball). A hardcoded copy went stale at 0.1.1 —
+ * two declarations of one fact. */
+declare const CHECK_VERSION: string;
+
+export { CHECK_VERSION, type CallSite, CallSiteSchema, type CheckResult, type Confidence, DESTINATION_SENTENCE, type EngineOptions, type Extract, ExtractSchema, type Finding, OBSERVE_DAY_PLAN, SERVER_INSTRUCTIONS, START_CHECK_INSTRUCTIONS, type Severity, buildServer, renderCard, renderModelFacts, runCheck };

package/dist/index.js

@@ -1,4 +1,5 @@
 import {
+  CHECK_VERSION,
   CallSiteSchema,
   DESTINATION_SENTENCE,
   ExtractSchema,
@@ -7,9 +8,11 @@ import {
   START_CHECK_INSTRUCTIONS,
   buildServer,
   renderCard,
+  renderModelFacts,
   runCheck
-} from "./chunk-2DPBQQWM.js";
+} from "./chunk-NHTVNYK2.js";
 export {
+  CHECK_VERSION,
   CallSiteSchema,
   DESTINATION_SENTENCE,
   ExtractSchema,
@@ -18,5 +21,6 @@ export {
   START_CHECK_INSTRUCTIONS,
   buildServer,
   renderCard,
+  renderModelFacts,
   runCheck
 };

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@warmdrift/kgauto-check",
-  "version": "0.1.1",
-  "description": "Point your AI at your project — kgauto's local MCP check. Your coding agent extracts your AI surface (identifiers and counts, never code) and this server checks it against kgauto's verified model catalog: statuses, prices, cliffs, capability mismatches, resilience. Runs fully offline; nothing is uploaded, no rows are written anywhere.",
+  "version": "0.3.0",
+  "description": "Point your AI at your project — kgauto's local check, as a pure CLI for coding agents. Your agent extracts the project's AI surface (identifiers and counts, never code) and this tool checks it against kgauto's verified model catalog: statuses, prices, cliffs, capability mismatches, resilience. Fully offline; --share is the one explicit opt-in exception.",
   "type": "module",
   "bin": {
-    "kgauto-check-mcp": "dist/bin.js"
+    "kgauto-check": "dist/bin.js"
   },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -19,7 +19,7 @@
     "build": "tsup src/index.ts src/bin.ts --format esm --dts --clean",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
-    "smoke": "npm run build && node scripts/smoke-stdio.mjs",
+    "smoke": "npm run build && node scripts/smoke-stdio.mjs && node scripts/smoke-cli.mjs",
     "prepublishOnly": "npm run typecheck && npm run test && npm run build"
   },
   "keywords": [
@@ -38,8 +38,8 @@
     "directory": "check-mcp"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "@warmdrift/kgauto-compiler": "^2.0.0-alpha.88",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@warmdrift/kgauto-compiler": "^2.0.0-alpha.95",
     "zod": "^3.23.0"
   },
   "devDependencies": {