@webpresso/agent-kit 3.1.30 → 3.3.0

package/dist/esm/mcp/blueprint/handlers/task-verify.js

@@ -10,8 +10,9 @@ import { hashMutationPayload, readMutationReplay, recordMutationReplay, validate
 import { bytes } from "#mcp/blueprint/_shared/payload";
 import { findBlueprintDir, resolveToolProject } from "#mcp/blueprint/_shared/project";
 import { handleTaskNext } from "#mcp/blueprint/handlers/task-next";
-import { writeFileAtomic } from "#shared-utils/write-json-file.js";
-import { applyVerification, readTaskVerification } from "#verification.js";
+import { readTaskVerification } from "#verification.js";
+import { applyBlueprintLifecycle } from "#lifecycle/engine.js";
+import { applyBlueprintLifecycleToFile } from "#lifecycle/local.js";
 const ALL_STATES = ["draft", "planned", "in-progress", "parked", "archived", "completed"];
 // Task 3.2 — wp_blueprint_task_verify
 const taskVerifySchema = z.object({
@@ -52,13 +53,31 @@ export async function handleTaskVerify(projectResolver, cwd, raw) {
         return err("wp_blueprint_task_verify failed", `Blueprint overview not found at ${filePath}`);
     }
     const markdownBefore = readFileSync(filePath, "utf8");
-    // Idempotency check: if the task already has the same canonical evidence block, skip write.
-    // We check this BEFORE calling applyVerification to avoid whitespace normalization drift
-    // making `result.markdown !== markdownBefore` always true even for identical evidence.
     const incomingCanonical = canonicalizeEvidenceList(evidence);
     const existingEvidence = readTaskVerification(markdownBefore, task_id);
+    let result;
+    try {
+        result = applyBlueprintLifecycle(markdownBefore, slug, {
+            type: "task_verify",
+            taskId: task_id,
+            evidence,
+        });
+    }
+    catch (error) {
+        return jsonContent({
+            summary: "Verification failed",
+            failures: [error instanceof Error ? error.message : String(error)],
+            next_action: makeNextAction("verify_task", error instanceof Error ? error.message : String(error)),
+            bytes: 0,
+            tokensSaved: 0,
+        }, true);
+    }
+    // Idempotency includes all lifecycle-owned fields. Reapplying identical
+    // evidence repairs stale progress/last_updated metadata once, then becomes a
+    // byte-for-byte no-op.
     if (existingEvidence !== null &&
-        canonicalizeEvidenceList(existingEvidence) === incomingCanonical) {
+        canonicalizeEvidenceList(existingEvidence) === incomingCanonical &&
+        result.markdown === markdownBefore) {
         const nextPayload = parseStructuredJson(await handleTaskNext(projectResolver, projectCwd, {
             blueprint: slug,
             project_id: resolvedProject.project_id ?? projectCwd,
@@ -82,19 +101,20 @@ export async function handleTaskVerify(projectResolver, cwd, raw) {
         }
         return finishPayload(payload);
     }
-    // Apply verification (pure function — no FS side effects)
-    const result = applyVerification(markdownBefore, task_id, evidence);
-    if (!result.ok) {
-        return jsonContent({
-            summary: "Verification failed",
-            failures: result.failures,
-            next_action: makeNextAction("verify_task", result.failures[0] ?? "Verification failed"),
-            bytes: 0,
-            tokensSaved: 0,
-        }, true);
-    }
-    // Write updated markdown back to disk
-    writeFileAtomic(filePath, result.markdown, "utf8");
+    // Write the mutated markdown back to disk via the file-aware lifecycle
+    // wrapper, not a raw write to the pre-mutation path: the pure engine call
+    // above can change the blueprint's frontmatter `status` (e.g. draft ->
+    // in-progress on the first task mutation), and that status change must be
+    // paired with the matching physical folder move -- the same contract the
+    // CLI router and BlueprintService already honor via
+    // applyBlueprintLifecycleToFile. Writing to the original `filePath`
+    // unconditionally would leave folder and status disagreeing whenever the
+    // blueprint started outside in-progress/.
+    await applyBlueprintLifecycleToFile(projectCwd, slug, {
+        type: "task_verify",
+        taskId: task_id,
+        evidence,
+    });
     // Re-ingest so the DB projection reflects the completed status
     try {
         await reIngest(projectCwd);

package/dist/esm/mcp/blueprint/registration.js

@@ -107,16 +107,17 @@ export async function registerBlueprintTools(registrar, cwd, projectResolver = c
         type: "object",
         properties: { blueprint: { type: "string" }, project_id: { type: "string" } },
     }, undefined, (r) => handleTaskNext(projectResolver, cwd, r), { title: "Blueprint Task Next", readOnlyHint: true, openWorldHint: false });
-    registrar.registerTool("wp_blueprint_task_advance", "Advance task status. Edits the canonical blueprint markdown and re-syncs DB. Accepts optional request_id for idempotent retries and optional head_at_ingest from wp_blueprint_get/wp_blueprint_list to reject stale writes. Returns { summary, old_status, new_status, idempotent }.", {
+    registrar.registerTool("wp_blueprint_task_advance", "Advance task status within a specific blueprint. Requires slug to scope the mutation — task ids (e.g. 2.1) are not unique across blueprints in a project, so slug prevents advancing the wrong blueprint. Edits the canonical blueprint markdown and re-syncs DB. Accepts optional request_id for idempotent retries and optional head_at_ingest from wp_blueprint_get/wp_blueprint_list to reject stale writes. Returns { summary, old_status, new_status, idempotent }.", {
         type: "object",
         properties: {
             project_id: { type: "string" },
+            slug: { type: "string" },
             task_id: { type: "string" },
             to: { type: "string", enum: ["todo", "in-progress", "blocked", "done", "dropped"] },
             request_id: { type: "string" },
             head_at_ingest: { type: ["string", "null"] },
         },
-        required: ["project_id", "task_id", "to"],
+        required: ["project_id", "slug", "task_id", "to"],
     }, {
         ...summaryEnvelopeOutputSchema,
         properties: {

package/dist/esm/mcp/server.d.ts

@@ -7,6 +7,7 @@
  * — no edits required here.
  */
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+export declare function resolveMcpToolAllowlist(raw?: string | undefined): ReadonlySet<string> | null;
 export declare function isBunSingleFileModuleUrl(moduleUrl: string): boolean;
 export type ToolLoadMode = "filesystem" | "registry";
 export declare function resolveDefaultToolLoadMode(moduleUrl?: string): ToolLoadMode;

package/dist/esm/mcp/server.js

@@ -16,6 +16,24 @@ import { COMPILED_TOOL_REGISTRY } from "./tools/_registry.js";
 import { readOwnedPackageVersion } from "#runtime/package-version.js";
 const SERVER_NAME = "webpresso";
 const SERVER_VERSION = readOwnedPackageVersion(import.meta.url);
+const MCP_TOOL_ALLOWLIST_ENV = "WP_MCP_TOOL_ALLOWLIST";
+export function resolveMcpToolAllowlist(raw = process.env[MCP_TOOL_ALLOWLIST_ENV]) {
+    if (raw === undefined)
+        return null;
+    const names = raw
+        .split(",")
+        .map((name) => name.trim())
+        .filter(Boolean);
+    if (names.length === 0 || new Set(names).size !== names.length) {
+        throw new Error(`${MCP_TOOL_ALLOWLIST_ENV} must contain a non-empty, duplicate-free comma-separated tool list`);
+    }
+    for (const name of names) {
+        if (!/^wp_[a-z0-9_]+$/u.test(name)) {
+            throw new Error(`${MCP_TOOL_ALLOWLIST_ENV} contains invalid tool name: ${name}`);
+        }
+    }
+    return new Set(names);
+}
 function modulePathFromUrl(moduleUrl) {
     try {
         return fileURLToPath(moduleUrl);
@@ -53,8 +71,11 @@ export async function createServer(options = {}) {
         },
     });
     const tools = new Map();
+    const allowlist = resolveMcpToolAllowlist();
     const registrar = {
         registerTool(name, description, inputSchema, outputSchema, handler, annotations) {
+            if (allowlist !== null && !allowlist.has(name))
+                return;
             tools.set(name, { name, description, inputSchema, outputSchema, handler, annotations });
         },
     };
@@ -90,6 +111,12 @@ export async function createServer(options = {}) {
             }
         },
     });
+    if (allowlist !== null) {
+        const missing = [...allowlist].filter((name) => !tools.has(name));
+        if (missing.length > 0) {
+            throw new Error(`${MCP_TOOL_ALLOWLIST_ENV} names unavailable tools: ${missing.sort().join(", ")}`);
+        }
+    }
     // Empty prompts/resources/resource-templates handlers, registered exactly
     // the same way other MCP servers do. Several MCP clients —
     // including Claude Code 2.1.x and OpenCode — call listPrompts() or

package/dist/esm/mcp/tools/_names.d.ts

@@ -8,4 +8,4 @@
  * is enforced by `_names.test.ts` against `COMPILED_TOOL_REGISTRY`, so this list
  * cannot silently drift.
  */
-export declare const WP_TOOL_NAMES: readonly ["wp_audit", "wp_audits", "wp_bench", "wp_ci_act", "wp_e2e", "wp_fleet_status", "wp_format", "wp_gain", "wp_lint", "wp_pr_status", "wp_pr_upsert", "wp_pr_wait", "wp_qa", "wp_release_readiness", "wp_session_batch_execute", "wp_session_capture", "wp_session_context", "wp_session_doctor", "wp_session_execute", "wp_session_execute_file", "wp_session_fetch_and_index", "wp_session_index", "wp_session_purge", "wp_session_retrieve", "wp_session_restore", "wp_session_search", "wp_session_snapshot", "wp_session_stats", "wp_test", "wp_typecheck", "wp_ultragoal_cancel", "wp_ultragoal_handoff", "wp_ultragoal_new", "wp_ultragoal_run", "wp_ultragoal_status", "wp_worker_tail", "wp_worktree"];
+export declare const WP_TOOL_NAMES: readonly ["wp_audit", "wp_audits", "wp_bench", "wp_ci_act", "wp_ci_preflight", "wp_e2e", "wp_fleet_status", "wp_format", "wp_gain", "wp_lint", "wp_pr_status", "wp_pr_upsert", "wp_pr_wait", "wp_qa", "wp_release_readiness", "wp_review_run", "wp_run_wait", "wp_session_batch_execute", "wp_session_capture", "wp_session_context", "wp_session_doctor", "wp_session_execute", "wp_session_execute_file", "wp_session_fetch_and_index", "wp_session_id", "wp_session_index", "wp_session_info", "wp_session_purge", "wp_session_retrieve", "wp_session_restore", "wp_session_search", "wp_session_snapshot", "wp_session_stats", "wp_test", "wp_typecheck", "wp_ultragoal_cancel", "wp_ultragoal_handoff", "wp_ultragoal_new", "wp_ultragoal_run", "wp_ultragoal_status", "wp_worker_tail", "wp_worktree"];

package/dist/esm/mcp/tools/_names.js

@@ -13,6 +13,7 @@ export const WP_TOOL_NAMES = [
     "wp_audits",
     "wp_bench",
     "wp_ci_act",
+    "wp_ci_preflight",
     "wp_e2e",
     "wp_fleet_status",
     "wp_format",
@@ -23,6 +24,8 @@ export const WP_TOOL_NAMES = [
     "wp_pr_wait",
     "wp_qa",
     "wp_release_readiness",
+    "wp_review_run",
+    "wp_run_wait",
     "wp_session_batch_execute",
     "wp_session_capture",
     "wp_session_context",
@@ -30,7 +33,9 @@ export const WP_TOOL_NAMES = [
     "wp_session_execute",
     "wp_session_execute_file",
     "wp_session_fetch_and_index",
+    "wp_session_id",
     "wp_session_index",
+    "wp_session_info",
     "wp_session_purge",
     "wp_session_retrieve",
     "wp_session_restore",

package/dist/esm/mcp/tools/_registry.js

@@ -2,6 +2,7 @@ import audit from "./audit.js";
 import audits from "./audits.js";
 import bench from "./bench.js";
 import ciAct from "./ci-act.js";
+import ciPreflight from "./ci-preflight.js";
 import e2e from "./e2e.js";
 import format from "./format.js";
 import fleet from "./fleet.js";
@@ -12,6 +13,8 @@ import prUpsert from "./pr-upsert.js";
 import prWait from "./pr-wait.js";
 import qa from "./qa.js";
 import releaseReadiness from "./release-readiness.js";
+import reviewRun from "./review-run.js";
+import runWait from "./run-wait.js";
 import sessionBatchExecute from "./session-batch-execute.js";
 import sessionCapture from "./session-capture.js";
 import sessionContext from "./session-context.js";
@@ -19,7 +22,9 @@ import sessionDoctor from "./session-doctor.js";
 import sessionExecute from "./session-execute.js";
 import sessionExecuteFile from "./session-execute-file.js";
 import sessionFetchAndIndex from "./session-fetch-and-index.js";
+import sessionId from "./session-id.js";
 import sessionIndex from "./session-index.js";
+import sessionInfo from "./session-info.js";
 import sessionPurge from "./session-purge.js";
 import sessionRetrieve from "./session-retrieve.js";
 import sessionRestore from "./session-restore.js";
@@ -40,6 +45,7 @@ export const COMPILED_TOOL_REGISTRY = [
     audits,
     bench,
     ciAct,
+    ciPreflight,
     e2e,
     fleet,
     format,
@@ -50,6 +56,8 @@ export const COMPILED_TOOL_REGISTRY = [
     prWait,
     qa,
     releaseReadiness,
+    reviewRun,
+    runWait,
     sessionBatchExecute,
     sessionCapture,
     sessionContext,
@@ -57,7 +65,9 @@ export const COMPILED_TOOL_REGISTRY = [
     sessionExecute,
     sessionExecuteFile,
     sessionFetchAndIndex,
+    sessionId,
     sessionIndex,
+    sessionInfo,
     sessionPurge,
     sessionRetrieve,
     sessionRestore,

package/dist/esm/mcp/tools/_shared/audit-kinds.d.ts

@@ -1,3 +1,3 @@
-export declare const MCP_AUDIT_KINDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "test-scan-perf", "session-memory-hardcut", "worktree-main-ownership", "sast"];
+export declare const MCP_AUDIT_KINDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "host-substitution-risk", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "test-scan-perf", "session-memory-hardcut", "worktree-main-ownership", "typescript-version", "ci-guardrails-wiring", "sast", "changeset-required"];
 export type MCPAuditKind = (typeof MCP_AUDIT_KINDS)[number];
 export declare function isMCPAuditKind(value: string): value is MCPAuditKind;

package/dist/esm/mcp/tools/_shared/result.js

@@ -82,8 +82,51 @@ export function clipRawOutput(rawOutput, maxChars = DEFAULT_RAW_OUTPUT_LIMIT, op
         ...(recorded?.warning ? { warnings: [recorded.warning] } : {}),
     };
 }
+/**
+ * Maximum bytes of serialized `details` appended to an ERROR result's text
+ * content. Generous enough to carry a full validation-error array or a failed
+ * command record, small enough that a pathological payload cannot flood the
+ * caller's context.
+ */
+const ERROR_DETAIL_TEXT_LIMIT = 2_000;
+/**
+ * Render the actionable part of a failing payload for the text `content`.
+ *
+ * MCP hosts surface `content` (not `structuredContent`) when `isError` is set,
+ * so an error whose text is only the one-line `summary` forces the caller to
+ * go read the tool's source to learn WHAT failed — e.g. `wp_pr_upsert`
+ * returning bare "PR description validation failed; no GitHub mutation was
+ * attempted" while `details.validation.errors` held the exact missing fields.
+ * That round trip is pure wasted context. Fold the details into the text so
+ * one call is enough.
+ */
+function renderErrorDetail(payload) {
+    const details = payload.details;
+    if (details === undefined || details === null)
+        return undefined;
+    let serialized;
+    try {
+        // Compact (no pretty-print indentation): keeps the payload cheap in the
+        // caller's context, and avoids emitting whitespace runs that never came
+        // from the data — `session-index.test.ts` asserts a whitespace-only INPUT
+        // is not echoed back, which indented output would trip incidentally.
+        serialized = JSON.stringify(details);
+    }
+    catch {
+        return undefined; // circular/unserializable — summary alone still ships
+    }
+    if (!serialized || serialized === "{}" || serialized === "[]")
+        return undefined;
+    return serialized.length <= ERROR_DETAIL_TEXT_LIMIT
+        ? serialized
+        : `${serialized.slice(0, ERROR_DETAIL_TEXT_LIMIT - 1)}…`;
+}
 export function createSummaryResult(payload, options = {}) {
-    const text = clipSummaryText(options.text ?? payload.summary);
+    const summaryText = clipSummaryText(options.text ?? payload.summary);
+    // Only errors get the detail block: success results are already summary-first
+    // by design, and their details are available via `structuredContent`.
+    const detail = options.isError ? renderErrorDetail(payload) : undefined;
+    const text = detail ? `${summaryText}\n\n${detail}` : summaryText;
     return {
         content: [{ type: "text", text }],
         structuredContent: payload,

package/dist/esm/mcp/tools/audit.d.ts

@@ -15,7 +15,7 @@
  */
 import { z } from "zod";
 import type { ToolDescriptor } from "#mcp/auto-discover";
-export declare const KINDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "test-scan-perf", "session-memory-hardcut", "worktree-main-ownership", "sast"];
+export declare const KINDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "host-substitution-risk", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "test-scan-perf", "session-memory-hardcut", "worktree-main-ownership", "typescript-version", "ci-guardrails-wiring", "sast", "changeset-required"];
 export declare const inputSchema: z.ZodObject<{
     kind: z.ZodEnum<{
         "absolute-path-policy": "absolute-path-policy";
@@ -29,6 +29,8 @@ export declare const inputSchema: z.ZodObject<{
         "blueprint-trust": "blueprint-trust";
         "bundle-budget": "bundle-budget";
         "catalog-drift": "catalog-drift";
+        "changeset-required": "changeset-required";
+        "ci-guardrails-wiring": "ci-guardrails-wiring";
         "ci-test-perf": "ci-test-perf";
         "cloudflare-deploy-contract": "cloudflare-deploy-contract";
         "commit-message": "commit-message";
@@ -38,6 +40,7 @@ export declare const inputSchema: z.ZodObject<{
         "harness-overlay-evidence": "harness-overlay-evidence";
         "harness-surfaces": "harness-surfaces";
         "hook-surface": "hook-surface";
+        "host-substitution-risk": "host-substitution-risk";
         "no-dev-vars": "no-dev-vars";
         "no-first-party-mjs": "no-first-party-mjs";
         "no-math-random": "no-math-random";
@@ -58,6 +61,7 @@ export declare const inputSchema: z.ZodObject<{
         "test-smells": "test-smells";
         "toolchain-isolation": "toolchain-isolation";
         "tph-e2e": "tph-e2e";
+        "typescript-version": "typescript-version";
         "weakness-mining": "weakness-mining";
         "worktree-main-ownership": "worktree-main-ownership";
     }>;

package/dist/esm/mcp/tools/audit.js

@@ -128,6 +128,16 @@ export async function dispatchAudit(input) {
                 details: auditResult,
             };
         }
+        case "host-substitution-risk": {
+            const { auditHostSubstitutionRisk } = await import("#audit/host-substitution-risk");
+            const auditResult = auditHostSubstitutionRisk(input.cwd ?? input.directory ?? process.cwd());
+            return {
+                passed: auditResult.ok,
+                summary: summarizeRepoAudit(kind, auditResult),
+                kind,
+                details: auditResult,
+            };
+        }
         case "agents": {
             const { auditAgents } = await import("#audit/agents");
             const auditResult = auditAgents(input.cwd ?? input.directory ?? process.cwd());
@@ -464,6 +474,16 @@ export async function dispatchAudit(input) {
                 details: auditResult,
             };
         }
+        case "ci-guardrails-wiring": {
+            const { auditCiGuardrailsWiring } = await import("#audit/ci-guardrails-wiring");
+            const auditResult = auditCiGuardrailsWiring(input.cwd ?? input.directory ?? process.cwd());
+            return {
+                passed: auditResult.ok,
+                summary: summarizeRepoAudit(kind, auditResult),
+                kind,
+                details: auditResult,
+            };
+        }
         case "test-scan-perf": {
             const { auditTestScanPerf } = await import("#audit/test-scan-perf");
             const auditResult = auditTestScanPerf(input.cwd ?? input.directory ?? process.cwd());
@@ -539,6 +559,28 @@ export async function dispatchAudit(input) {
                 },
             };
         }
+        case "typescript-version": {
+            const { auditTypescriptVersion } = await import("#audit/typescript-version");
+            const auditResult = auditTypescriptVersion(input.cwd ?? input.directory ?? process.cwd());
+            return {
+                passed: auditResult.ok,
+                summary: summarizeRepoAudit(kind, auditResult),
+                kind,
+                details: auditResult,
+            };
+        }
+        case "changeset-required": {
+            const { auditChangesetRequired } = await import("#audit/changeset-required");
+            const auditResult = auditChangesetRequired(input.cwd ?? input.directory ?? process.cwd(), {
+                baseRef: input.baseRef,
+            });
+            return {
+                passed: auditResult.ok,
+                summary: summarizeRepoAudit(kind, auditResult),
+                kind,
+                details: auditResult,
+            };
+        }
         default: {
             // Exhaustiveness check — z.enum should make this unreachable.
             const _exhaustive = kind;

package/dist/esm/mcp/tools/audits.d.ts

@@ -25,6 +25,8 @@ declare const inputSchema: z.ZodObject<{
         "blueprint-trust": "blueprint-trust";
         "bundle-budget": "bundle-budget";
         "catalog-drift": "catalog-drift";
+        "changeset-required": "changeset-required";
+        "ci-guardrails-wiring": "ci-guardrails-wiring";
         "ci-test-perf": "ci-test-perf";
         "cloudflare-deploy-contract": "cloudflare-deploy-contract";
         "commit-message": "commit-message";
@@ -34,6 +36,7 @@ declare const inputSchema: z.ZodObject<{
         "harness-overlay-evidence": "harness-overlay-evidence";
         "harness-surfaces": "harness-surfaces";
         "hook-surface": "hook-surface";
+        "host-substitution-risk": "host-substitution-risk";
         "no-dev-vars": "no-dev-vars";
         "no-first-party-mjs": "no-first-party-mjs";
         "no-math-random": "no-math-random";
@@ -54,6 +57,7 @@ declare const inputSchema: z.ZodObject<{
         "test-smells": "test-smells";
         "toolchain-isolation": "toolchain-isolation";
         "tph-e2e": "tph-e2e";
+        "typescript-version": "typescript-version";
         "weakness-mining": "weakness-mining";
         "worktree-main-ownership": "worktree-main-ownership";
     }>>>;

package/dist/esm/mcp/tools/ci-preflight.d.ts

@@ -0,0 +1,50 @@
+/**
+ * `wp_ci_preflight` MCP tool.
+ *
+ * Wraps `runCiPreflight` (the single owner of the pre-push gate — see
+ * `src/cli/commands/ci-preflight.ts`) so agents can run the exact fail-fast,
+ * branch-scoped sequence CI mirrors — `format → guardrails → typecheck →
+ * lint → test` — without shelling out to `wp ci-preflight` via Bash.
+ *
+ * `runCiPreflight`'s default `runCheck` re-invokes `wp <subcommand>` via
+ * `spawnSync(..., {stdio: "inherit"})`. That is correct for a real terminal
+ * but unsafe here: `wp mcp` speaks stdio-transport JSON-RPC over the process's
+ * real stdout, and an inherited child write would corrupt that stream. This
+ * tool substitutes a `runCheck` that spawns each stage asynchronously via the
+ * shared `runCommand` helper (captured stdout/stderr, a bounded per-stage
+ * timeout, and `extra.signal` cancellation) using the same `wp` launcher
+ * resolution (`resolveWpLauncher`) the CLI uses, so behavior stays identical
+ * — only the transport of the output changes. `runCiPreflight`'s own
+ * `stdout`/`stderr` deps are swallowed for the same reason (they default to
+ * `process.stdout`/`process.stderr`); the equivalent progress detail is
+ * reconstructed from the per-stage results this tool collects itself.
+ *
+ * `runCiPreflight` returns only an exit code — there is no structured
+ * per-stage payload to "pass through." The `{passed, summary, details:
+ * {stages, stoppedAt}}` shape below mirrors `wp_qa`'s aggregate-gate
+ * convention (structured pass/fail + per-stage breakdown) since ci-preflight
+ * is the same shape of thing: a staged composite gate, just sequential and
+ * fail-fast instead of `wp_qa`'s parallel `Promise.all`.
+ */
+import { z } from "zod";
+import type { ToolDescriptor } from "#mcp/auto-discover";
+declare const inputSchema: z.ZodObject<{
+    cwd: z.ZodOptional<z.ZodString>;
+    full: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$strip>;
+export type AkCiPreflightInput = z.infer<typeof inputSchema>;
+declare const stageResultSchema: z.ZodObject<{
+    label: z.ZodString;
+    args: z.ZodArray<z.ZodString>;
+    passed: z.ZodBoolean;
+    exitCode: z.ZodOptional<z.ZodNumber>;
+    timedOut: z.ZodOptional<z.ZodBoolean>;
+    aborted: z.ZodOptional<z.ZodBoolean>;
+    spawnError: z.ZodOptional<z.ZodString>;
+    rawOutput: z.ZodOptional<z.ZodString>;
+    truncated: z.ZodOptional<z.ZodBoolean>;
+    logPath: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type CiPreflightStageResult = z.infer<typeof stageResultSchema>;
+declare const tool: ToolDescriptor;
+export default tool;