@webpresso/agent-kit 3.1.28 → 3.1.30

package/dist/esm/cli/commands/quality-log-store.js

@@ -1,7 +1,7 @@
-import { randomUUID } from "node:crypto";
-import { closeSync, createWriteStream, mkdirSync, openSync, readdirSync, readFileSync, statSync, renameSync, utimesSync, rmSync, writeFileSync, } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { createWriteStream, mkdirSync, openSync, readdirSync, readFileSync, statSync, renameSync, utimesSync, rmSync, writeFileSync, } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { getSurfacePath } from "#paths/state-root.js";
 import { readTrustedJsonFile } from "#shared-utils/read-json-file.js";
 import { shortId } from "#shared-utils/short-id.js";
@@ -16,6 +16,7 @@ export const CLI_LOG_COMMANDS = [
     "format",
 ];
 const ORPHAN_LOG_GRACE_MS = 60_000;
+const INDEX_LOCK_STALE_MS = 5_000;
 export function isCliLogCommandName(value) {
     return CLI_LOG_COMMANDS.includes(value);
 }
@@ -63,39 +64,39 @@ function openCliLogSink(commandDir, command, cwd) {
             stream.write(chunk);
         },
         async finalize(metadata) {
-            await new Promise((resolve, reject) => {
-                if (streamError) {
-                    reject(streamError);
-                    return;
-                }
-                rejectPendingFinalize = reject;
-                stream.end(() => {
-                    rejectPendingFinalize = undefined;
+            try {
+                await new Promise((resolve, reject) => {
                     if (streamError) {
                         reject(streamError);
                         return;
                     }
-                    resolve();
+                    rejectPendingFinalize = reject;
+                    stream.end(() => {
+                        rejectPendingFinalize = undefined;
+                        if (streamError) {
+                            reject(streamError);
+                            return;
+                        }
+                        resolve();
+                    });
                 });
-            });
-            const entry = {
-                id,
-                command,
-                timestamp: metadata.timestamp ?? new Date().toISOString(),
-                exitCode: metadata.exitCode,
-                logPath: absoluteLogPath,
-                ...(metadata.options ? { options: metadata.options } : {}),
-                ...(metadata.summary ? { summary: metadata.summary } : {}),
-            };
-            try {
+                const entry = {
+                    id,
+                    command,
+                    timestamp: metadata.timestamp ?? new Date().toISOString(),
+                    exitCode: metadata.exitCode,
+                    logPath: absoluteLogPath,
+                    ...(metadata.options ? { options: metadata.options } : {}),
+                    ...(metadata.summary ? { summary: metadata.summary } : {}),
+                };
                 markLogRecentlyFinalized(absoluteLogPath);
                 // Index/lock live next to the log file so fallback dirs stay consistent.
                 writeLogEntryInDir(entry, commandDir);
+                return entry;
             }
             finally {
                 rmSync(activeMarkerPath, { force: true });
             }
-            return entry;
         },
     };
 }
@@ -113,7 +114,7 @@ export function createCliLogSink(command, cwd = process.cwd()) {
     catch (error) {
         if (!isUnwritableFsError(error))
             throw error;
-        const fallbackDir = join(tmpdir(), "webpresso", "cli-logs", command);
+        const fallbackDir = getFallbackCommandLogDir(command, cwd);
         const code = typeof error === "object" && error !== null && "code" in error
             ? String(error.code)
             : "unknown";
@@ -122,13 +123,37 @@ export function createCliLogSink(command, cwd = process.cwd()) {
     }
 }
 export function readCliLogEntries(command, cwd = process.cwd()) {
-    const indexPath = getCommandIndexPath(command, cwd);
+    const entries = [
+        ...readCliLogEntriesFromCommandDir(command, getCommandLogDir(command, cwd)),
+        ...readCliLogEntriesFromCommandDir(command, getFallbackCommandLogDir(command, cwd)),
+    ];
+    const byLogPath = new Map();
+    for (const entry of entries) {
+        byLogPath.set(entry.logPath, entry);
+    }
+    return [...byLogPath.values()]
+        .sort((a, b) => {
+        if (a.active === true && b.active !== true)
+            return -1;
+        if (b.active === true && a.active !== true)
+            return 1;
+        return b.timestamp.localeCompare(a.timestamp);
+    })
+        .slice(0, 10);
+}
+function readCliLogEntriesFromCommandDir(command, commandDir) {
+    const activeEntries = readActiveCliLogEntriesFromDir(command, commandDir);
+    const indexPath = join(commandDir, "index.json");
     try {
         const parsed = readTrustedJsonFile(indexPath);
-        return Array.isArray(parsed.entries) ? parsed.entries : [];
+        const finalizedEntries = Array.isArray(parsed.entries) ? parsed.entries : [];
+        return [
+            ...activeEntries,
+            ...finalizedEntries.filter((entry) => !activeEntries.some((active) => active.id === entry.id)),
+        ].slice(0, 10);
     }
     catch {
-        return [];
+        return activeEntries;
     }
 }
 export function readCliLogEntry(command, ordinal = 1, cwd = process.cwd()) {
@@ -146,6 +171,45 @@ function readCliLogEntriesFromDir(commandDir) {
         return [];
     }
 }
+function readActiveCliLogEntriesFromDir(command, commandDir) {
+    let files;
+    try {
+        files = readdirSync(commandDir);
+    }
+    catch {
+        return [];
+    }
+    return files
+        .filter((file) => file.endsWith(".log.active"))
+        .map((file) => readActiveCliLogEntryFromMarker(command, join(commandDir, file)))
+        .filter((entry) => entry !== null)
+        .sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+}
+function readActiveCliLogEntryFromMarker(command, markerPath) {
+    try {
+        const markerStat = statSync(markerPath);
+        const marker = readFileSync(markerPath, "utf8");
+        const id = basename(markerPath).slice(0, -".log.active".length);
+        if (!id)
+            return null;
+        const markerLines = marker.split("\n");
+        const live = isActiveMarkerSnapshotLive(marker, markerStat.mtimeMs);
+        return {
+            id,
+            command,
+            timestamp: markerLines[1]?.trim() || new Date(markerStat.mtimeMs).toISOString(),
+            exitCode: -1,
+            logPath: markerPath.slice(0, -".active".length),
+            ...(live ? { active: true } : {}),
+            summary: live ? "active log" : "orphaned log from exited process",
+        };
+    }
+    catch (error) {
+        if (isMissingFileError(error))
+            return null;
+        throw error;
+    }
+}
 function writeLogEntryInDir(entry, commandDir) {
     withCommandIndexLockInDir(commandDir, () => {
         const indexPath = join(commandDir, "index.json");
@@ -169,28 +233,86 @@ function writeLogEntryInDir(entry, commandDir) {
 }
 function withCommandIndexLockInDir(commandDir, fn) {
     mkdirSync(commandDir, { recursive: true });
-    const lockPath = join(commandDir, "index.lock");
+    const lockDir = join(commandDir, "index.lock.d");
+    mkdirSync(lockDir, { recursive: true });
+    const ownerPath = join(lockDir, `${Date.now()}-${process.pid}-${randomUUID()}.owner`);
+    writeFileSync(ownerPath, `${process.pid}\n${new Date().toISOString()}\n`, {
+        encoding: "utf8",
+        flag: "wx",
+    });
     const started = Date.now();
-    let fd;
-    while (fd === undefined) {
-        try {
-            fd = openSync(lockPath, "wx");
-        }
-        catch (error) {
-            if (!isFileExistsError(error))
-                throw error;
-            if (Date.now() - started > 5_000) {
-                throw new Error(`Timed out waiting for CLI log index lock: ${lockPath}`);
+    try {
+        while (!isCurrentIndexLockOwner(lockDir, ownerPath)) {
+            if (Date.now() - started > INDEX_LOCK_STALE_MS) {
+                throw new Error(`Timed out waiting for CLI log index lock: ${lockDir}`);
             }
             sleepSync(10);
         }
-    }
-    try {
         return fn();
     }
     finally {
-        closeSync(fd);
-        rmSync(lockPath, { force: true });
+        rmSync(ownerPath, { force: true });
+    }
+}
+function isCurrentIndexLockOwner(lockDir, ownerPath) {
+    const liveOwners = readLiveIndexLockOwners(lockDir);
+    const firstOwner = liveOwners[0];
+    if (firstOwner === undefined)
+        return false;
+    return firstOwner.path === ownerPath;
+}
+function readLiveIndexLockOwners(lockDir) {
+    let files;
+    try {
+        files = readdirSync(lockDir);
+    }
+    catch (error) {
+        if (isMissingFileError(error))
+            return [];
+        throw error;
+    }
+    return files
+        .filter((file) => file.endsWith(".owner"))
+        .map((file) => readIndexLockOwner(join(lockDir, file)))
+        .filter((owner) => owner !== null)
+        .sort((a, b) => a.timestampMs - b.timestampMs || a.path.localeCompare(b.path));
+}
+function readIndexLockOwner(ownerPath) {
+    let marker = "";
+    let markerMtimeMs = 0;
+    try {
+        const markerStat = statSync(ownerPath);
+        markerMtimeMs = markerStat.mtimeMs;
+        marker = readFileSync(ownerPath, "utf8");
+    }
+    catch (error) {
+        if (isMissingFileError(error))
+            return null;
+        throw error;
+    }
+    const markerLines = marker.split("\n");
+    const pid = Number(markerLines[0]);
+    const hasOwner = Number.isInteger(pid) && pid > 0;
+    const timestamp = Date.parse(markerLines[1] ?? "");
+    const timestampMs = Number.isFinite(timestamp) ? timestamp : markerMtimeMs;
+    const stale = (hasOwner && !isProcessLive(pid)) ||
+        (!hasOwner && Date.now() - markerMtimeMs > INDEX_LOCK_STALE_MS);
+    if (stale) {
+        rmSync(ownerPath, { force: true });
+        return null;
+    }
+    return { path: ownerPath, timestampMs };
+}
+function isProcessLive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        if (typeof error === "object" && error !== null && "code" in error) {
+            return error.code === "EPERM";
+        }
+        return false;
     }
 }
 function writeIndexAtomically(indexPath, index) {
@@ -233,31 +355,45 @@ function canPruneLogPath(logPath) {
     }
 }
 function isActiveLogPath(logPath) {
+    const activeMarkerPath = getActiveMarkerPath(logPath);
     try {
-        readFileSync(getActiveMarkerPath(logPath), "utf8");
-        return true;
+        const markerStat = statSync(activeMarkerPath);
+        const marker = readFileSync(activeMarkerPath, "utf8");
+        const live = isActiveMarkerSnapshotLive(marker, markerStat.mtimeMs);
+        if (!live)
+            rmSync(activeMarkerPath, { force: true });
+        return live;
     }
-    catch {
+    catch (error) {
+        if (!isMissingFileError(error))
+            throw error;
         return false;
     }
 }
+function isActiveMarkerSnapshotLive(marker, markerMtimeMs) {
+    const pid = Number(marker.split("\n")[0]);
+    if (Number.isInteger(pid) && pid > 0) {
+        return isProcessLive(pid);
+    }
+    return Date.now() - markerMtimeMs <= ORPHAN_LOG_GRACE_MS;
+}
 function getActiveMarkerPath(logPath) {
     return `${logPath}.active`;
 }
 function sleepSync(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
-function isFileExistsError(error) {
-    return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
-}
 function isMissingFileError(error) {
     return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
 function getCommandLogDir(command, cwd) {
     return getSurfacePath(join("cli-logs", command), "repo", cwd);
 }
-function getCommandIndexPath(command, cwd) {
-    return join(getCommandLogDir(command, cwd), "index.json");
+function getFallbackCommandLogDir(command, cwd) {
+    return join(tmpdir(), "webpresso", "cli-logs", fallbackScopeId(cwd), command);
+}
+function fallbackScopeId(cwd) {
+    return createHash("sha256").update(resolve(cwd)).digest("hex").slice(0, 12);
 }
 function createLogId(now = new Date()) {
     const iso = now.toISOString().replaceAll(":", "-").replaceAll(".", "-");

package/dist/esm/cli/commands/review.js

@@ -7,6 +7,7 @@ import { z } from "zod";
 import { MAX_PORTABLE_REPOSITORY_PATH_LENGTH } from "#audit/absolute-path-policy.js";
 import { getProjectRoot } from "#cli/utils";
 import { relativeBlueprintSlug, resolveBlueprintFile } from "#lifecycle/local.js";
+import { readBlueprintOverviewAtRef } from "#lifecycle/review-provenance.js";
 import { scanBlueprintDirectory } from "#service/scanner.js";
 import { resolveBlueprintRoot } from "#utils/blueprint-root.js";
 import { CLAUDE_DEFAULT_REVIEW_MODEL, CODEX_DEFAULT_REVIEW_MODEL, GROK_DEFAULT_REVIEW_MODEL, DEFAULT_REVIEW_MAX_PROGRESS_EVENTS, runReviewExecution, } from "#review/execution/index.js";
@@ -860,14 +861,10 @@ function readBlueprintAtTarget(projectRoot, blueprintPath, targetSha) {
         throw new Error(`Blueprint path is outside Git toplevel: ${blueprintPath}`);
     }
     const relative = gitRelativePath.replace(/\\/gu, "/");
-    try {
-        return runBoundedReviewGit(gitRoot, ["show", `${targetSha}:${relative}`]);
-    }
-    catch (error) {
-        throw new Error(`Blueprint ${relative} is not tracked at target ${targetSha}.`, {
-            cause: error,
-        });
-    }
+    const content = readBlueprintOverviewAtRef(gitRoot, targetSha, absoluteBlueprintPath);
+    if (content)
+        return content.toString("utf8");
+    throw new Error(`Blueprint ${relative} is not tracked at target ${targetSha}.`);
 }
 function blueprintPathAtGitRoot(projectRoot, blueprintPath) {
     const gitRoot = resolveReviewGitToplevel(projectRoot);

package/dist/esm/cli/commands/secrets.d.ts

@@ -2,6 +2,7 @@ import type { CAC } from "cac";
 import { spawnRuntimeCommandSync } from "#runtime/executor.js";
 export interface SecretsCommandOptions {
     readonly cwd?: string;
+    readonly commandCwd?: string;
     readonly profile?: string;
     readonly sink?: string;
     readonly json?: boolean;

package/dist/esm/cli/commands/secrets.js

@@ -14,6 +14,7 @@ export function registerSecretsCommand(cli) {
         .command("secrets <action> [target]", "Secret orchestration commands (doctor, bootstrap github)")
         .option("--profile <name>", "Secret profile name", { default: "preview" })
         .option("--sink <id>", "Secret sink id")
+        .option("--command-cwd <dir>", "Run the scoped command from this directory")
         .option("--json", "Emit machine-readable JSON")
         .option("--lane <lane>", "Lane to bootstrap (repeatable)", { default: [] })
         .option("--apply", "Apply GitHub bootstrap changes instead of dry-run planning")
@@ -22,6 +23,7 @@ export function registerSecretsCommand(cli) {
             cwd: process.cwd(),
             profile: flags.profile,
             sink: flags.sink,
+            commandCwd: flags.commandCwd,
             json: Boolean(flags.json),
             lanes: toArray(flags.lane),
             apply: Boolean(flags.apply),
@@ -109,7 +111,8 @@ export function runSecretsRun(options = {}, deps = {}) {
     const result = (deps.runSecretScopedCommand ?? spawnRuntimeCommandSync)({
         command,
         args,
-        cwd: options.cwd,
+        cwd: options.commandCwd ?? options.cwd,
+        envCwd: options.cwd,
         profile: plan.runtimeProfile,
         secretProfile: plan.profile,
         environment: plan.environment,

package/dist/esm/cli/direct-provider-launch.js

@@ -11,6 +11,7 @@ import { canonicalizeWorktreePath } from "#worktrees/identity.js";
 import { dashProviderOwnershipName, parseDashPermissionMode, } from "#cli/commands/dash/provider-capabilities.js";
 import { optionalToolCanonicalCommand } from "#cli/optional-tools.js";
 import { commandExists } from "#runtime/command-exists.js";
+import { ensureCodexProjectMcpServers, ensureCodexWebpressoMcp, } from "#cli/commands/init/scaffolders/codex-mcp/index.js";
 export class DirectProviderLaunchPreparationError extends Error {
     action;
     constructor(message, action) {
@@ -90,6 +91,25 @@ function validateDirectProviderLaunch(provider, cwd) {
         vpCommand,
     };
 }
+function ensureCodexSessionTooling(repoRoot) {
+    const options = { dryRun: false, overwrite: false };
+    const webpresso = ensureCodexWebpressoMcp({ options });
+    if (webpresso.kind === "codex-webpresso-mcp-not-installed") {
+        throw new DirectProviderLaunchPreparationError(`Codex webpresso MCP is not configured because no usable agent-kit install root was found. Checked: ${webpresso.checked.join(", ") || "(none)"}`, "Run `wp setup --yes-global` from this repo, then retry `wp codex`.");
+    }
+    const project = ensureCodexProjectMcpServers({ repoRoot, options });
+    if (project.kind === "codex-project-mcp-invalid") {
+        throw new DirectProviderLaunchPreparationError(`Codex project MCP config is invalid: ${project.reason}`, "Fix .mcp.json or run `wp setup --yes-global` for detailed setup diagnostics.");
+    }
+    if (project.kind === "codex-project-mcp-unavailable") {
+        throw new DirectProviderLaunchPreparationError(`Codex project MCP server ${project.server} is unavailable: ${project.reason}`, "Run `wp setup --yes-global` from this repo to provision project MCP servers, then retry.");
+    }
+}
+function ensureProviderSessionTooling(provider, cwd) {
+    if (provider !== "codex")
+        return;
+    ensureCodexSessionTooling(cwd);
+}
 export function isBareInteractiveProviderLaunch(args) {
     return parseDashPermissionMode(args).args.length === 0;
 }
@@ -136,14 +156,17 @@ export async function prepareDirectProviderLaunch(provider, args, cwd) {
         return { cwd, warnings: [] };
     }
     const { managedCwd, warnings } = await prepareLaunchEnvironment(provider, cwd);
-    if (managedCwd)
+    if (managedCwd) {
+        ensureProviderSessionTooling(provider, managedCwd);
         return { cwd: managedCwd, warnings };
+    }
     const created = await createManagedWorktree({
         cwd,
         prefix: provider,
         base: "origin/main",
         dependencyHydration: dependencyHydrationForProvider(provider),
     });
+    ensureProviderSessionTooling(provider, created.path);
     return { cwd: created.path, warnings };
 }
 /**
@@ -163,5 +186,6 @@ export function dependencyHydrationForProvider(provider) {
  */
 export async function prepareDirectProviderLaunchAt(provider, cwd) {
     const { warnings } = await prepareLaunchEnvironment(provider, cwd);
+    ensureProviderSessionTooling(provider, cwd);
     return { cwd, warnings };
 }

package/dist/esm/hooks/doctor.d.ts

@@ -116,6 +116,21 @@ export declare function checkCodexConfigKeys(configFilePath?: string, deps?: Hos
  * (exact `vp dlx` pins, launcher rules) at doctor time instead of only at setup.
  */
 export declare function checkProjectMcpPins(cwd?: string, deps?: HostConfigDoctorDeps): DoctorCheck;
+export interface ClaudeMcpDuplicateRegistrationOptions {
+    readonly home?: string;
+    readonly exists?: (path: string) => boolean;
+    readonly readFile?: (path: string) => string;
+}
+/**
+ * `claude-mcp-duplicate-registration` — advisory. A machine can register the
+ * webpresso MCP server twice for the same Claude Code session: a manual
+ * `claude mcp add webpresso` entry in `~/.claude.json` (user scope or a
+ * project scope) plus the agent-kit marketplace plugin's bundled server
+ * (plugin cache under `~/.claude/plugins/`). Both spawn `wp mcp`, so affected
+ * sessions run two server processes and carry a duplicated wp_* tool list.
+ * Degrades to ok on missing/unreadable config — loud only on real duplication.
+ */
+export declare function checkClaudeMcpDuplicateRegistration(options?: ClaudeMcpDuplicateRegistrationOptions): DoctorCheck;
 export interface DanglingHostPathsOptions {
     readonly configFilePath?: string;
     readonly home?: string;

package/dist/esm/hooks/doctor.js

@@ -1790,6 +1790,61 @@ export function checkProjectMcpPins(cwd = process.cwd(), deps = {}) {
             : `${parsed.definitions.length} exact-pinned vp dlx server(s) validated`,
     };
 }
+/**
+ * `claude-mcp-duplicate-registration` — advisory. A machine can register the
+ * webpresso MCP server twice for the same Claude Code session: a manual
+ * `claude mcp add webpresso` entry in `~/.claude.json` (user scope or a
+ * project scope) plus the agent-kit marketplace plugin's bundled server
+ * (plugin cache under `~/.claude/plugins/`). Both spawn `wp mcp`, so affected
+ * sessions run two server processes and carry a duplicated wp_* tool list.
+ * Degrades to ok on missing/unreadable config — loud only on real duplication.
+ */
+export function checkClaudeMcpDuplicateRegistration(options = {}) {
+    const name = "claude MCP duplicate registration";
+    const home = options.home ?? homedir();
+    const exists = options.exists ?? existsSync;
+    const readFile = options.readFile ?? ((candidate) => readFileSync(candidate, "utf8"));
+    const pluginCacheDir = join(home, ".claude", "plugins", "cache", "webpresso", "agent-kit");
+    if (!exists(pluginCacheDir)) {
+        return { name, ok: true, detail: "skipped (agent-kit Claude plugin not installed)" };
+    }
+    const claudeJsonPath = join(home, ".claude.json");
+    if (!exists(claudeJsonPath)) {
+        return { name, ok: true, detail: "skipped (no ~/.claude.json)" };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFile(claudeJsonPath));
+    }
+    catch {
+        return { name, ok: true, detail: "skipped (~/.claude.json unreadable)" };
+    }
+    if (parsed === null || typeof parsed !== "object") {
+        return { name, ok: true, detail: "skipped (~/.claude.json is not an object)" };
+    }
+    const config = parsed;
+    const manualSources = [];
+    if (config.mcpServers && "webpresso" in config.mcpServers) {
+        manualSources.push("user scope");
+    }
+    for (const [projectDir, project] of Object.entries(config.projects ?? {})) {
+        if (project?.mcpServers && "webpresso" in project.mcpServers) {
+            manualSources.push(`project scope ${projectDir}`);
+        }
+    }
+    if (manualSources.length === 0) {
+        return { name, ok: true, detail: "plugin-scoped registration only" };
+    }
+    return {
+        name,
+        ok: false,
+        advisory: true,
+        detail: `the agent-kit Claude plugin bundles the webpresso MCP server, but ~/.claude.json also ` +
+            `registers "webpresso" manually (${manualSources.join(", ")}). Affected sessions run two ` +
+            `wp mcp processes with a duplicated wp_* tool list. Remove the manual entry: ` +
+            `claude mcp remove webpresso (run inside the project directory for project-scope entries).`,
+    };
+}
 const QUOTED_TOML_STRING = /"((?:[^"\\]|\\.)*)"/gu;
 const DANGLING_SYMLINK_SCAN_DEPTH = 3;
 function collectDanglingWorktreePaths(raw, worktreesRoot, exists, alreadyReported) {
@@ -1994,6 +2049,7 @@ export async function runHooksDoctor(opts = {}) {
         checks.push(checkCodexConfigKeys());
     }
     checks.push(checkProjectMcpPins(opts.cwd));
+    checks.push(checkClaudeMcpDuplicateRegistration());
     checks.push({ advisory: true, ...checkDanglingHostPaths() });
     checks.push({ advisory: true, ...checkRootLauncherContract() });
     checks.push({ advisory: true, ...checkNativePluginRuntime() });

package/dist/esm/hooks/pretool-guard/validators/forbidden-commands.js

@@ -371,7 +371,7 @@ function findWpAuditRedirect(command) {
     for (const variant of getCommandVariants(command)) {
         const kind = WP_AUDIT_RE.exec(variant)?.[1];
         if (kind === "guardrails") {
-            return `"${variant}" denied — use the MCP batch audit tool: mcp__webpresso__wp_audits(preset="guardrails"). Returns aggregate structured, summary-first results.`;
+            return `"${variant}" denied — use the webpresso MCP batch audit tool: wp_audits(preset="guardrails"). Returns aggregate structured, summary-first results.`;
         }
         if (!kind || !AUDIT_KIND_SET.has(kind))
             continue;
@@ -381,11 +381,11 @@ function findWpAuditRedirect(command) {
             knownKinds.push(kind);
     }
     if (knownKinds.length > 1) {
-        return `Multiple wp audit commands denied — use the MCP batch audit tool: mcp__webpresso__wp_audits(kinds=[${knownKinds.map((kind) => `"${kind}"`).join(", ")}]). Returns aggregate structured, summary-first results.`;
+        return `Multiple wp audit commands denied — use the webpresso MCP batch audit tool: wp_audits(kinds=[${knownKinds.map((kind) => `"${kind}"`).join(", ")}]). Returns aggregate structured, summary-first results.`;
     }
     const kind = knownKinds[0];
     if (kind && firstKnownVariant) {
-        return `"${firstKnownVariant}" denied — use the MCP audit tool: mcp__webpresso__wp_audit(kind="${kind}"). Returns structured, summary-first results.`;
+        return `"${firstKnownVariant}" denied — use the webpresso MCP audit tool: wp_audit(kind="${kind}"). Returns structured, summary-first results.`;
     }
     return undefined;
 }
@@ -402,7 +402,7 @@ function findScriptRouteRedirect(command, routes) {
             process.stderr.write(`[forbidden-commands] guard.scriptRoutes["${script}"] -> "${kind}" is not a known audit kind; ignoring\n`);
             continue;
         }
-        return `"${variant}" denied — this repo routes \`${script}\` to an audit: mcp__webpresso__wp_audit(kind="${kind}").`;
+        return `"${variant}" denied — this repo routes \`${script}\` to an audit: use the webpresso MCP tool wp_audit(kind="${kind}").`;
     }
     return undefined;
 }

package/dist/esm/hooks/pretool-guard/validators/mcp-redirect.d.ts

@@ -1,6 +1,5 @@
 import type { CommandCategory } from "./forbidden-commands.js";
 export interface MCPRedirectConfig {
-    serverName?: string;
     toolPrefix?: string;
 }
 export interface MCPRedirectContext {

package/dist/esm/hooks/pretool-guard/validators/mcp-redirect.js

@@ -1,5 +1,4 @@
 import { isMcpReady } from "#hooks/shared/mcp-sentinel";
-const DEFAULT_SERVER_NAME = "webpresso";
 const DEFAULT_TOOL_PREFIX = "wp_";
 let cachedDefaultMcpReady;
 export function resetMcpReadyCache() {
@@ -22,7 +21,6 @@ export function resolveMcpReady(value) {
 }
 export function resolveMcpConfig(mcp) {
     return {
-        serverName: mcp?.serverName?.trim() || DEFAULT_SERVER_NAME,
         toolPrefix: mcp?.toolPrefix?.trim() || DEFAULT_TOOL_PREFIX,
     };
 }
@@ -50,10 +48,15 @@ export function buildRedirectMessage(ctx) {
     if (!resolveMcpReady(ctx.mcpReady)) {
         return `"${ctx.command}" denied — MCP not ready. Use: ${fallbackHint}`;
     }
-    const { serverName, toolPrefix } = resolveMcpConfig(ctx.mcp);
-    const toolMatchers = toolSuffixesForCategory(ctx.category).map((suffix) => `mcp__${serverName}__${toolPrefix}${suffix}(...)`);
+    // Suffix-only tool names: hosts register the webpresso MCP server under
+    // different prefixes (manual `mcp__webpresso__*` vs plugin-scoped
+    // `mcp__plugin_agent-kit_webpresso__*`), so a hardcoded full name resolves in
+    // some sessions and dangles in others. The `wp_<suffix>` identity is stable
+    // across every registration shape.
+    const { toolPrefix } = resolveMcpConfig(ctx.mcp);
+    const toolMatchers = toolSuffixesForCategory(ctx.category).map((suffix) => `${toolPrefix}${suffix}(...)`);
     return [
-        `"${ctx.command}" denied — use wp MCP tool:`,
+        `"${ctx.command}" denied — use the webpresso MCP tool:`,
         ...toolMatchers.map((matcher) => `  ${matcher}`),
         "Returns structured, summary-first results. Raw output is clipped; overflow may include a log path for deeper investigation.",
         `Fallback if MCP unavailable: ${fallbackHint}`,

package/dist/esm/hooks/pretool-guard/validators/worktree-discipline.d.ts

@@ -17,13 +17,15 @@ import type { ToolInput, ValidationResult } from "#hooks/shared/types";
  *  effective cwd elsewhere (e.g. CI)        → ALLOW (rule scoped to local ~/repos primaries)
  * ```
  *
- * The "effective cwd" is the tool's ambient `input.cwd`, lowered only by a
- * success-gated cwd chain that directly governs the forbidden git op, e.g.
- * `cd <worktree> && git commit` or `(cd <worktree> && git commit)`, then by
- * EVERY `git -C <dir>` flag on the matched invocation (git applies them
- * cumulatively). Unsupported cwd-changing control flow, option-bearing `cd`,
- * `cd -`, or unresolvable `cd`/`-C` targets fail closed because they could hide
- * a primary-checkout mutation. Prefer `git -C <worktree> ...` or running the
+ * The "effective cwd" is the tool's ambient `input.cwd`, lowered by a
+ * success-gated `&&` chain that governs the forbidden git op, e.g.
+ * `cd <worktree> && git commit`, `cd <worktree> && ./bin/wp … && git commit`,
+ * or `(cd <worktree> && git commit)`, then by EVERY `git -C <dir>` flag on the
+ * matched invocation (git applies them cumulatively). Intermediate non-cwd
+ * commands after a proven `cd` leave the chain cwd unchanged. Unsupported
+ * control flow (`;` / `|` / braces), option-bearing `cd`, `cd -`, or
+ * unresolvable `cd`/`-C` targets fail closed because they could hide a
+ * primary-checkout mutation. Prefer `git -C <worktree> ...` or running the
  * command with the tool cwd already set to the worktree.
  *
  * Known best-effort limits (acceptable for an agent guard with a documented