@webpresso/agent-kit 0.21.0

package/dist/esm/mcp/runners/test.js

@@ -0,0 +1,330 @@
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { globSync } from 'glob';
+import { isRunFailure, runCommand as runSharedCommand } from '#mcp/tools/_shared/run-command';
+// Keep the runner's own deadline comfortably below common MCP client call
+// ceilings so slow suites fail fast with a structured `timedOut` payload
+// instead of appearing to hang.
+const DEFAULT_TEST_TIMEOUT_MS = 30_000;
+const DEFAULT_TEST_TOTAL_BUDGET_MS = 90_000;
+const WORKSPACE_SHARD_MIN_FILES = 6;
+const WORKSPACE_TARGET_FILES_PER_SHARD = 5;
+const WORKSPACE_MAX_SHARDS = 8;
+const VITEST_DEFAULT_INCLUDE = '**/*.{test,spec}.?(c|m)[jt]s?(x)';
+const VITEST_DEFAULT_IGNORE = [
+    '**/node_modules/**',
+    '**/dist/**',
+    '**/coverage/**',
+    '**/.git/**',
+    '**/.{idea,cache,output,temp}/**',
+    '**/{karma,rollup,webpack,vite,vitest,jest,ava,babel,nyc,cypress,tsup,build}.config.*',
+];
+/**
+ * Run tests via the `vp` facade over the repo-declared package-manager substrate.
+ *
+ * Argv shape:
+ *   - `vp run --filter <p> test` once per package when packages are given (results
+ *     aggregated; first non-zero exit wins).
+ *   - `vp run test -- <file1> <file2>` when files are given (no packages).
+ *   - `vp run test` otherwise.
+ */
+export async function runTests(input) {
+    const cwd = input.cwd ?? process.env.CLAUDE_PROJECT_DIR ?? process.cwd();
+    const commandTimeoutMs = input.timeoutMs ?? DEFAULT_TEST_TIMEOUT_MS;
+    const workspaceSharding = resolveWorkspaceSharding(input.workspaceSharding, input.timeoutMs);
+    if (input.packages && input.packages.length > 0) {
+        return runPackageSequence(cwd, input.packages, input, workspaceSharding);
+    }
+    if (input.files && input.files.length > 0) {
+        if (usesVitest(cwd)) {
+            const fileShardRuns = createVitestShardRunsFromFiles(cwd, input.files, workspaceSharding);
+            if (fileShardRuns && fileShardRuns.length > 0) {
+                return runScopedSequence(cwd, fileShardRuns, input, workspaceSharding);
+            }
+            const result = await runCommand('vp', ['exec', '--', 'vitest', 'run', '--reporter=json', '--no-color', ...input.files], { ...input, cwd, timeoutMs: commandTimeoutMs });
+            return withFailureScope(result, 'file-filter command');
+        }
+        const result = await runCommand('vp', ['run', 'test', '--', ...input.files], {
+            ...input,
+            cwd,
+            timeoutMs: commandTimeoutMs,
+        });
+        return withFailureScope(result, 'file-filter command');
+    }
+    const workspaceShardRuns = createWorkspaceVitestShardRuns(cwd, workspaceSharding);
+    if (workspaceShardRuns && workspaceShardRuns.length > 0) {
+        return runScopedSequence(cwd, workspaceShardRuns, input, workspaceSharding);
+    }
+    const result = await runCommand('vp', ['run', 'test'], {
+        ...input,
+        cwd,
+        timeoutMs: commandTimeoutMs,
+    });
+    return withFailureScope(result, 'workspace command');
+}
+async function runPackageSequence(cwd, packages, input, workspaceSharding) {
+    const budget = createRunBudget(workspaceSharding.totalBudgetMs);
+    let combinedOutput = '';
+    let firstFailure = 0;
+    let timedOut = false;
+    let aborted = false;
+    let failureScope;
+    for (const pkg of packages) {
+        const remainingMs = getRemainingBudgetMs(budget);
+        if (remainingMs <= 0) {
+            timedOut = true;
+            if (firstFailure === 0) {
+                firstFailure = 124;
+                failureScope = 'overall test budget';
+            }
+            combinedOutput += formatScopedOutput('overall test budget', `Global test budget exhausted before package ${pkg}.`);
+            break;
+        }
+        const result = await runPackageScopedTests(cwd, pkg, {
+            ...input,
+            timeoutMs: getScopedCommandTimeoutMs(input, remainingMs),
+        });
+        combinedOutput += formatScopedOutput(`package ${pkg}`, result.output);
+        if (!result.passed && firstFailure === 0) {
+            firstFailure = result.exitCode;
+            failureScope = `package ${pkg}`;
+        }
+        if (result.timedOut)
+            timedOut = true;
+        if (result.aborted)
+            aborted = true;
+        if (result.timedOut || result.aborted)
+            break;
+    }
+    return {
+        passed: firstFailure === 0,
+        output: combinedOutput,
+        exitCode: firstFailure,
+        timedOut,
+        aborted,
+        failureScope,
+    };
+}
+async function runScopedSequence(cwd, runs, input, workspaceSharding) {
+    const budget = createRunBudget(workspaceSharding.totalBudgetMs);
+    let combinedOutput = '';
+    let firstFailure = 0;
+    let timedOut = false;
+    let aborted = false;
+    let failureScope;
+    for (const run of runs) {
+        const remainingMs = getRemainingBudgetMs(budget);
+        if (remainingMs <= 0) {
+            timedOut = true;
+            if (firstFailure === 0) {
+                firstFailure = 124;
+                failureScope = 'overall test budget';
+            }
+            combinedOutput += formatScopedOutput('overall test budget', `Global test budget exhausted before ${run.scope}.`);
+            break;
+        }
+        const result = await runCommand('vp', run.args, {
+            cwd,
+            signal: input.signal,
+            timeoutMs: getScopedCommandTimeoutMs(input, remainingMs),
+        });
+        combinedOutput += formatScopedOutput(run.scope, result.output);
+        if (!result.passed && firstFailure === 0) {
+            firstFailure = result.exitCode;
+            failureScope = run.scope;
+        }
+        if (result.timedOut)
+            timedOut = true;
+        if (result.aborted)
+            aborted = true;
+        if (result.timedOut || result.aborted)
+            break;
+    }
+    return {
+        passed: firstFailure === 0,
+        output: combinedOutput,
+        exitCode: firstFailure,
+        timedOut,
+        aborted,
+        failureScope,
+    };
+}
+function createRunBudget(totalBudgetMs) {
+    return { deadlineMs: Date.now() + totalBudgetMs };
+}
+function getRemainingBudgetMs(budget) {
+    return Math.max(0, budget.deadlineMs - Date.now());
+}
+function getScopedCommandTimeoutMs(input, remainingMs) {
+    return Math.min(input.timeoutMs ?? remainingMs, remainingMs);
+}
+function resolveWorkspaceSharding(input, explicitTimeoutMs) {
+    return {
+        enabled: input?.enabled ?? true,
+        minFilesToShard: input?.minFilesToShard ?? WORKSPACE_SHARD_MIN_FILES,
+        targetFilesPerShard: input?.targetFilesPerShard ?? WORKSPACE_TARGET_FILES_PER_SHARD,
+        maxShards: input?.maxShards ?? WORKSPACE_MAX_SHARDS,
+        totalBudgetMs: input?.totalBudgetMs ?? explicitTimeoutMs ?? DEFAULT_TEST_TOTAL_BUDGET_MS,
+    };
+}
+function formatScopedOutput(scope, output) {
+    const trimmed = output.trim();
+    if (!trimmed)
+        return `[scope: ${scope}]\n`;
+    return `[scope: ${scope}]\n${trimmed}\n`;
+}
+function withFailureScope(result, scope) {
+    if (result.passed)
+        return result;
+    if (result.failureScope)
+        return result;
+    return { ...result, failureScope: scope };
+}
+function createWorkspaceVitestShardRuns(cwd, workspaceSharding) {
+    if (!workspaceSharding.enabled)
+        return undefined;
+    if (!hasRootVitestTestScript(cwd))
+        return undefined;
+    const files = discoverVitestFiles(cwd);
+    if (files.length < workspaceSharding.minFilesToShard)
+        return undefined;
+    const shards = buildBalancedShards(cwd, files, workspaceSharding);
+    const shardTotal = shards.length;
+    if (shardTotal <= 1)
+        return undefined;
+    return shards.map((filesInShard, index) => ({
+        scope: `shard ${index + 1}/${shardTotal} (${filesInShard.length} files)`,
+        args: ['exec', '--', 'vitest', 'run', '--reporter=json', '--no-color', ...filesInShard],
+    }));
+}
+function createVitestShardRunsFromFiles(cwd, files, workspaceSharding) {
+    if (!workspaceSharding.enabled)
+        return undefined;
+    if (files.length < workspaceSharding.minFilesToShard)
+        return undefined;
+    const shards = buildBalancedShards(cwd, files, workspaceSharding);
+    const shardTotal = shards.length;
+    if (shardTotal <= 1)
+        return undefined;
+    return shards.map((filesInShard, index) => ({
+        scope: `file shard ${index + 1}/${shardTotal} (${filesInShard.length} files)`,
+        args: ['exec', '--', 'vitest', 'run', '--reporter=json', '--no-color', ...filesInShard],
+    }));
+}
+function hasRootVitestTestScript(cwd) {
+    const packageJson = findPackageJson(cwd);
+    if (!packageJson)
+        return false;
+    const pkg = readPackage(packageJson);
+    const scripts = pkg.scripts;
+    if (!scripts || typeof scripts !== 'object' || Array.isArray(scripts))
+        return false;
+    const testScript = scripts.test;
+    return typeof testScript === 'string' && /\bvitest\b/.test(testScript);
+}
+function discoverVitestFiles(cwd) {
+    return globSync(VITEST_DEFAULT_INCLUDE, {
+        cwd,
+        nodir: true,
+        ignore: [...VITEST_DEFAULT_IGNORE],
+    }).sort((left, right) => left.localeCompare(right));
+}
+function buildBalancedShards(cwd, files, workspaceSharding) {
+    const shardCount = Math.min(workspaceSharding.maxShards, Math.max(2, Math.ceil(files.length / workspaceSharding.targetFilesPerShard)));
+    const buckets = Array.from({ length: shardCount }, () => ({ files: [], bytes: 0 }));
+    const sortedByWeight = [...files]
+        .map((file) => ({ file, bytes: estimateFileWeight(cwd, file) }))
+        .sort((left, right) => {
+        if (right.bytes !== left.bytes)
+            return right.bytes - left.bytes;
+        return left.file.localeCompare(right.file);
+    });
+    for (const candidate of sortedByWeight) {
+        const lightestBucket = buckets.reduce((best, bucket) => (bucket.bytes < best.bytes ? bucket : best));
+        lightestBucket.files.push(candidate.file);
+        lightestBucket.bytes += candidate.bytes;
+    }
+    return buckets
+        .filter((bucket) => bucket.files.length > 0)
+        .map((bucket) => bucket.files.sort((left, right) => left.localeCompare(right)));
+}
+function estimateFileWeight(cwd, file) {
+    try {
+        return Math.max(1, statSync(join(cwd, file)).size);
+    }
+    catch {
+        return 1;
+    }
+}
+function runPackageScopedTests(cwd, packageName, input) {
+    const files = input.files;
+    const options = { cwd, signal: input.signal, timeoutMs: input.timeoutMs };
+    if (usesVitest(cwd, packageName)) {
+        return runCommand('vp', [
+            'exec',
+            '--filter',
+            packageName,
+            '--',
+            'vitest',
+            'run',
+            '--reporter=json',
+            '--no-color',
+            ...(files ?? []),
+        ], options);
+    }
+    if (files && files.length > 0) {
+        return runCommand('vp', ['run', '--filter', packageName, 'test', '--', ...files], options);
+    }
+    return runCommand('vp', ['run', '--filter', packageName, 'test'], options);
+}
+function usesVitest(cwd, packageName) {
+    const packageJson = findPackageJson(cwd, packageName);
+    if (!packageJson)
+        return false;
+    const pkg = readPackage(packageJson);
+    const sections = ['dependencies', 'devDependencies', 'optionalDependencies'];
+    return sections.some((section) => {
+        const deps = pkg[section];
+        return Boolean(deps && typeof deps === 'object' && !Array.isArray(deps) && 'vitest' in deps);
+    });
+}
+function findPackageJson(cwd, packageName) {
+    const candidates = packageName
+        ? [
+            join(cwd, 'packages', packageName, 'package.json'),
+            join(cwd, 'apps', packageName, 'package.json'),
+            join(cwd, packageName, 'package.json'),
+            join(cwd, 'package.json'),
+        ]
+        : [join(cwd, 'package.json')];
+    return candidates.find((candidate) => existsSync(candidate));
+}
+function readPackage(file) {
+    try {
+        const value = JSON.parse(readFileSync(file, 'utf8'));
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return {};
+        return value;
+    }
+    catch {
+        return {};
+    }
+}
+async function runCommand(cmd, args, options) {
+    const outcome = await runSharedCommand(cmd, args, {
+        cwd: options.cwd,
+        signal: options.signal,
+        timeoutMs: options.timeoutMs ?? DEFAULT_TEST_TIMEOUT_MS,
+    });
+    if (isRunFailure(outcome))
+        throw outcome.error;
+    const output = [outcome.stdout, outcome.stderr].filter(Boolean).join('');
+    return {
+        passed: outcome.exitCode === 0,
+        output,
+        exitCode: outcome.exitCode,
+        timedOut: outcome.timedOut,
+        aborted: outcome.aborted,
+    };
+}
+//# sourceMappingURL=test.js.map

package/dist/esm/mcp/server.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `wp mcp` stdio server.
+ *
+ * Builds an MCP {@link Server} and auto-registers every tool found under
+ * `src/mcp/tools/` (or, post-build, `dist/esm/mcp/tools/`). Adding a new tool
+ * is a matter of dropping a file with a default-exported {@link ToolDescriptor}
+ * — no edits required here.
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+export interface CreateServerOptions {
+    /**
+     * Directory to scan for tool descriptors. Defaults to `./tools` relative to
+     * this module — i.e. `src/mcp/tools/` in dev and `dist/esm/mcp/tools/` after
+     * `vp run build`.
+     */
+    toolsDir?: string;
+    /**
+     * Repo working directory passed through to the blueprint structured-store
+     * registrar (Task 2.1). Defaults to `process.cwd()`. Tests inject a tmpdir.
+     */
+    cwd?: string;
+}
+export declare function createServer(options?: CreateServerOptions): Promise<Server>;
+//# sourceMappingURL=server.d.ts.map

package/dist/esm/mcp/server.js

@@ -0,0 +1,142 @@
+/**
+ * `wp mcp` stdio server.
+ *
+ * Builds an MCP {@link Server} and auto-registers every tool found under
+ * `src/mcp/tools/` (or, post-build, `dist/esm/mcp/tools/`). Adding a new tool
+ * is a matter of dropping a file with a default-exported {@link ToolDescriptor}
+ * — no edits required here.
+ */
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { CallToolRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ListToolsRequestSchema, RootsListChangedNotificationSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { discoverTools, } from './auto-discover.js';
+import { registerBlueprintServer } from './blueprint-server.js';
+const SERVER_NAME = 'webpresso';
+// Walk upward from this module's location until we find package.json. Works
+// for both src/mcp/server.ts (dev) and dist/esm/mcp/server.js (built) without
+// hardcoding asymmetric `../../..` counts.
+const MAX_UPWARD_LEVELS = 8;
+function readPackageVersion() {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (let i = 0; i < MAX_UPWARD_LEVELS; i++) {
+        const candidate = join(dir, 'package.json');
+        if (existsSync(candidate)) {
+            const pkg = JSON.parse(readFileSync(candidate, 'utf-8'));
+            // Some build outputs emit a marker `package.json` (e.g. `{ "type": "module" }`)
+            // without a version. Skip those and keep walking so we land on the real
+            // package root, instead of throwing the moment we see any package.json.
+            if (typeof pkg.version === 'string' && pkg.version.length > 0)
+                return pkg.version;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    throw new Error('Cannot locate a versioned package.json relative to webpresso MCP server module');
+}
+const SERVER_VERSION = readPackageVersion();
+function defaultToolsDir() {
+    // import.meta.url resolves to either src/mcp/server.ts (dev/test via vitest)
+    // or dist/esm/mcp/server.js (built). The tools directory is colocated.
+    const here = dirname(fileURLToPath(import.meta.url));
+    return join(here, 'tools');
+}
+export async function createServer(options = {}) {
+    const server = new Server({ name: SERVER_NAME, version: SERVER_VERSION }, {
+        capabilities: {
+            tools: {},
+            // Advertise (empty) prompts/resources so clients that unconditionally
+            // list them during init don't fall through to a method-not-found path.
+            prompts: { listChanged: false },
+            resources: { listChanged: false },
+        },
+    });
+    const tools = new Map();
+    const registrar = {
+        registerTool(name, description, inputSchema, outputSchema, handler, annotations) {
+            tools.set(name, { name, description, inputSchema, outputSchema, handler, annotations });
+        },
+    };
+    await discoverTools(registrar, options.toolsDir ?? defaultToolsDir());
+    // Task 2.1: register the blueprint structured-store tools AFTER auto-discover
+    // so any tool-name collision surfaces here as a thrown error rather than
+    // silent shadowing. Roots are looked up lazily via `server.listRoots()`; the
+    // capability-missing throw is caught inside `registerBlueprintServer` so
+    // tool listing still works in clients that don't advertise roots.
+    const existingToolNames = new Set(tools.keys());
+    await registerBlueprintServer(registrar, {
+        cwd: options.cwd ?? process.cwd(),
+        existingToolNames,
+        getMcpRoots: () => server.listRoots(),
+        onRootsListChanged: (handler) => {
+            // F5: the SDK has no convenience `onRootsListChanged` property — the
+            // notification handler must be installed explicitly. Capability-missing
+            // clients simply never emit this notification, which is harmless.
+            try {
+                server.setNotificationHandler(RootsListChangedNotificationSchema, async () => {
+                    handler();
+                });
+            }
+            catch {
+                // Some test transports don't accept additional notification handlers;
+                // failing to install is non-fatal — list-changed is an optimization.
+            }
+        },
+    });
+    // Empty prompts/resources/resource-templates handlers, registered exactly
+    // like context-mode does (build/server.js:50-57). Several MCP clients —
+    // including Claude Code 2.1.x and OpenCode — call listPrompts() or
+    // listResources() during initialization. Without these handlers the SDK
+    // returns -32601 Method Not Found, which **poisons the transport layer**
+    // and causes subsequent listTools() calls to silently fail. The result:
+    // `claude mcp list` reports "Connected" but no tools appear in the
+    // session's deferred-tool registry. Fixed upstream by registering these.
+    server.setRequestHandler(ListPromptsRequestSchema, () => ({ prompts: [] }));
+    server.setRequestHandler(ListResourcesRequestSchema, () => ({ resources: [] }));
+    server.setRequestHandler(ListResourceTemplatesRequestSchema, () => ({ resourceTemplates: [] }));
+    server.setRequestHandler(ListToolsRequestSchema, () => {
+        return {
+            tools: [...tools.values()].map((t) => ({
+                name: t.name,
+                description: t.description,
+                inputSchema: t.inputSchema,
+                ...(t.outputSchema ? { outputSchema: t.outputSchema } : {}),
+                ...(t.annotations ? { annotations: t.annotations } : {}),
+            })),
+        };
+    });
+    // The MCP SDK passes a `RequestHandlerExtra` as the second arg containing
+    // `signal` (an AbortSignal that fires when the client cancels the call).
+    // We forward only `signal` to keep the tool surface narrow — tools must
+    // not depend on transport internals.
+    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+        const { name, arguments: args } = request.params;
+        const tool = tools.get(name);
+        if (!tool) {
+            const errorBlock = {
+                type: 'text',
+                text: `Unknown tool: ${name}`,
+            };
+            return { content: [errorBlock], isError: true };
+        }
+        const handlerExtra = extra?.signal ? { signal: extra.signal } : undefined;
+        try {
+            const result = await tool.handler(args ?? {}, handlerExtra);
+            return {
+                content: result.content,
+                ...(result.structuredContent ? { structuredContent: result.structuredContent } : {}),
+                isError: result.isError,
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const errorBlock = { type: 'text', text: message };
+            return { content: [errorBlock], isError: true };
+        }
+    });
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/esm/mcp/tools/_shared/project-root.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Resolve the webpresso MCP server's *project* root.
+ *
+ * Why this exists: Claude Code does NOT set a reliable cwd for plugin-scope
+ * MCP servers (anthropics/claude-code#42687, #17565, #19205). User-scope
+ * plugin servers see `process.cwd()` set to the plugin cache path; the
+ * `cwd` field in `.mcp.json` is documented but ignored. So `tsc` and
+ * `oxlint` spawned with the inherited cwd would lint the wrong tree.
+ *
+ * Resolution order, first hit wins:
+ *   1. `CLAUDE_PROJECT_DIR` env var (when set by Claude Code hooks).
+ *   2. Walk up from `process.cwd()` looking for a marker:
+ *      `.git`, `pnpm-workspace.yaml`, then `package.json`.
+ *   3. Loud throw — diagnosing a wrong-tree lint silently is worse than
+ *      forcing the caller to pass an explicit cwd.
+ *
+ * The walk searches `.git` and `pnpm-workspace.yaml` *before* `package.json`
+ * so we anchor at the workspace root rather than at a nested package dir.
+ */
+export declare class ProjectRootNotFoundError extends Error {
+    constructor(startedAt: string);
+}
+export interface ResolveProjectRootOptions {
+    readonly explicitCwd?: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly cwd?: string;
+}
+export declare function resolveProjectRoot(options?: ResolveProjectRootOptions): string;
+//# sourceMappingURL=project-root.d.ts.map

package/dist/esm/mcp/tools/_shared/project-root.js

@@ -0,0 +1,61 @@
+/**
+ * Resolve the webpresso MCP server's *project* root.
+ *
+ * Why this exists: Claude Code does NOT set a reliable cwd for plugin-scope
+ * MCP servers (anthropics/claude-code#42687, #17565, #19205). User-scope
+ * plugin servers see `process.cwd()` set to the plugin cache path; the
+ * `cwd` field in `.mcp.json` is documented but ignored. So `tsc` and
+ * `oxlint` spawned with the inherited cwd would lint the wrong tree.
+ *
+ * Resolution order, first hit wins:
+ *   1. `CLAUDE_PROJECT_DIR` env var (when set by Claude Code hooks).
+ *   2. Walk up from `process.cwd()` looking for a marker:
+ *      `.git`, `pnpm-workspace.yaml`, then `package.json`.
+ *   3. Loud throw — diagnosing a wrong-tree lint silently is worse than
+ *      forcing the caller to pass an explicit cwd.
+ *
+ * The walk searches `.git` and `pnpm-workspace.yaml` *before* `package.json`
+ * so we anchor at the workspace root rather than at a nested package dir.
+ */
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+const STRONG_MARKERS = ['.git', 'pnpm-workspace.yaml'];
+const WEWP_MARKERS = ['package.json'];
+const MAX_UPWARD_LEVELS = 32;
+export class ProjectRootNotFoundError extends Error {
+    constructor(startedAt) {
+        super(`Could not resolve project root walking up from ${startedAt} ` +
+            `(no .git, pnpm-workspace.yaml, or package.json found within ${MAX_UPWARD_LEVELS} levels). ` +
+            'Set CLAUDE_PROJECT_DIR or pass an explicit cwd.');
+        this.name = 'ProjectRootNotFoundError';
+    }
+}
+function walkUp(start, markers) {
+    let dir = start;
+    for (let i = 0; i < MAX_UPWARD_LEVELS; i++) {
+        if (markers.some((m) => existsSync(join(dir, m))))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+    return null;
+}
+export function resolveProjectRoot(options = {}) {
+    if (options.explicitCwd)
+        return options.explicitCwd;
+    const env = options.env ?? process.env;
+    const fromEnv = env.CLAUDE_PROJECT_DIR;
+    if (fromEnv && fromEnv.length > 0)
+        return fromEnv;
+    const start = options.cwd ?? process.cwd();
+    const fromStrong = walkUp(start, STRONG_MARKERS);
+    if (fromStrong)
+        return fromStrong;
+    const fromWeak = walkUp(start, WEWP_MARKERS);
+    if (fromWeak)
+        return fromWeak;
+    throw new ProjectRootNotFoundError(start);
+}
+//# sourceMappingURL=project-root.js.map

package/dist/esm/mcp/tools/_shared/redact.d.ts

@@ -0,0 +1,2 @@
+export declare function redactText(value: string | undefined): string | undefined;
+//# sourceMappingURL=redact.d.ts.map

package/dist/esm/mcp/tools/_shared/redact.js

@@ -0,0 +1,29 @@
+const KEY_PATTERNS = [
+    /\b(?:GH_PACKAGES_TOKEN|GITHUB_TOKEN|GITHUB_PAT|NEON_API_KEY(?:_PLATFORM)?|CHEF_CI_TOKEN)\b\s*=\s*([^\s]+)/giu,
+];
+const TOKEN_PATTERNS = [
+    /\bghp_[A-Za-z0-9]{20,}\b/gu,
+    /\b(?:cf|sk|tok)_[A-Za-z0-9_-]{16,}\b/gu,
+    /\b[A-Za-z0-9+/_-]{40,}\b/gu,
+];
+export function redactText(value) {
+    if (!value)
+        return value;
+    let output = value;
+    for (const pattern of KEY_PATTERNS) {
+        output = output.replace(pattern, (whole, token) => {
+            const trimmed = String(token ?? '').trim();
+            return whole.includes('=') ? whole.replace(trimmed, mask(trimmed)) : mask(trimmed);
+        });
+    }
+    for (const pattern of TOKEN_PATTERNS) {
+        output = output.replace(pattern, (token) => mask(token));
+    }
+    return output;
+}
+function mask(value) {
+    if (value.length <= 6)
+        return '[REDACTED]';
+    return `${value.slice(0, 2)}***${value.slice(-2)}`;
+}
+//# sourceMappingURL=redact.js.map