@wrongstack/cli 0.306.4 → 0.307.1

package/dist/{mcp-W7HHN7IA.js → mcp-CMLFHRG2.js}

@@ -38,11 +38,12 @@ var AllowAllPermissionPolicy = class extends AutoApprovePermissionPolicy {
     return { permission: "auto", source: "default" };
   }
 };
-function parseToolsFlag(flags) {
+function parseToolsFlag(flags, positional) {
   const raw = flags["tools"];
-  if (typeof raw !== "string") return null;
+  const csv = typeof raw === "string" ? raw : raw === true ? positional?.[0] ?? "" : "";
+  if (!csv) return null;
   const set = new Set(
-    raw.split(",").map((s) => s.trim()).filter(Boolean)
+    csv.split(",").map((s) => s.trim()).filter(Boolean)
   );
   return set.size > 0 ? set : null;
 }
@@ -190,10 +191,16 @@ async function selectExposedTools(registry, ctx, policy, whitelist) {
   }
   return allowed;
 }
-async function serveMcpStdio(deps) {
+async function serveMcpStdio(deps, positional) {
   const flags = deps.flags ?? {};
   const yolo = flags["yolo"] === true || flags["allow-all"] === true;
-  const whitelist = parseToolsFlag(flags);
+  const whitelist = parseToolsFlag(flags, positional);
+  if (flags["tools"] !== void 0 && whitelist === null) {
+    process.stderr.write(
+      "wrongstack MCP server: --tools requires a comma-separated tool list (e.g. `--tools read,grep` or `--tools=read,grep`)\n"
+    );
+    return 1;
+  }
   const log = (m) => process.stderr.write(`${m}
 `);
   let selectedContent;
@@ -325,7 +332,7 @@ var mcpCmd = async (args, deps) => {
   args = restoreFlags(args, deps, ["enable", "e", "transport", "url", "command"]);
   const sub = args[0];
   if (sub === "serve") {
-    return serveMcpStdio(deps);
+    return serveMcpStdio(deps, args.slice(1));
   }
   if (!sub || sub === "list") {
     const servers = deps.config.mcpServers ?? {};
@@ -432,4 +439,4 @@ function isRecord(value) {
 export {
   mcpCmd
 };
-//# sourceMappingURL=mcp-W7HHN7IA.js.map
+//# sourceMappingURL=mcp-CMLFHRG2.js.map

package/dist/mcp-serve.d.ts

@@ -3,6 +3,17 @@ import { ToolRegistry } from '@wrongstack/core/registry';
 import type { PermissionPolicy, Tool } from '@wrongstack/core/types';
 import { type MCPServerPrompt, type MCPServerResource } from '@wrongstack/mcp';
 import type { SubcommandDeps } from './subcommands/index.js';
+/**
+ * Resolve the `--tools` whitelist for `mcp serve`.
+ *
+ * `'tools'` is in BOOLEAN_FLAGS (a `models add` capability toggle), so
+ * parseArgs turns the space form `mcp serve --tools read,grep` into
+ * `tools: true` plus a positional CSV instead of a string value. Accept both
+ * shapes: a string value directly, or `true` + the following positional CSV.
+ * Returns null only when no list was supplied at all — callers must treat
+ * "flag present but no list" as an error, never as "no whitelist".
+ */
+export declare function parseToolsFlag(flags: Record<string, string | boolean>, positional?: readonly string[]): Set<string> | null;
 export interface SelectedMcpServeContent {
     resources: MCPServerResource[];
     prompts: MCPServerPrompt[];
@@ -38,5 +49,5 @@ export declare function makeServeContext(cwd: string, projectRoot: string, signa
  * Exported for testing — the live path calls it inside `serveMcpStdio`.
  */
 export declare function selectExposedTools(registry: ToolRegistry, ctx: Context, policy: PermissionPolicy, whitelist: Set<string> | null): Promise<Tool[]>;
-export declare function serveMcpStdio(deps: SubcommandDeps): Promise<number>;
+export declare function serveMcpStdio(deps: SubcommandDeps, positional?: readonly string[]): Promise<number>;
 //# sourceMappingURL=mcp-serve.d.ts.map