draftgo-cli 4.0.24 → 4.0.26

package/src/mcp/client.js

@@ -9,30 +9,37 @@ const {
 } = require('./protocol');
 const { allWithAbort } = require('./parallel');
 
-const SAFE_TEST_TOOLS = [
-  'draftgo_project_overview',
-  'draftgo_resource_list',
-  'draftgo_api_search',
-  'draftgo_api_describe',
-  'draftgo_api_call',
-];
-
-const REQUIRED_DRAFTGO_TOOLS = [
-  'draftgo_project_overview',
-  'draftgo_resource_list',
-  'draftgo_resource_search',
-  'draftgo_resource_get_metadata',
-  'draftgo_resource_read_fragment',
-  'draftgo_api_search',
-  'draftgo_api_describe',
-  'draftgo_api_call',
-];
+const SAFE_TEST_TOOLS = [
+  'draftgo_project_overview',
+  'draftgo_resource_list',
+  'draftgo_api_search',
+  'draftgo_api_describe',
+  'draftgo_api_call',
+];
+
+const REQUIRED_DRAFTGO_TOOLS = [
+  'draftgo_api_search',
+  'draftgo_api_describe',
+  'draftgo_api_call',
+];
+
+const TOOL_ALIASES = Object.freeze({
+  draftgo_api_search: Object.freeze([
+    'draftgo_api_search', 'draftgo_operation_search', 'search_operations', 'search',
+  ]),
+  draftgo_api_describe: Object.freeze([
+    'draftgo_api_describe', 'draftgo_operation_describe', 'describe_operation', 'describe',
+  ]),
+  draftgo_api_call: Object.freeze([
+    'draftgo_api_invoke', 'draftgo_api_call', 'draftgo_operation_invoke', 'invoke_operation', 'invoke', 'call',
+  ]),
+});
 
 function diagnosticArguments(canonicalName) {
   if (canonicalName === 'draftgo_resource_list') {
     return { resource_type: 'pages', limit: 1 };
   }
-  if (canonicalName === 'draftgo_api_search') return { query: 'project', limit: 1 };
+  if (canonicalName === 'draftgo_api_search') return { query: 'listDbMeta', limit: 1 };
   return {};
 }
 
@@ -45,15 +52,35 @@ function diagnosticData(result) {
   return value;
 }
 
-function findDBMetaListOperation(result) {
-  const value = diagnosticData(result);
-  const items = value && Array.isArray(value.items) ? value.items : [];
-  return items.find((operation) => operation
-    && String(operation.method || '').toUpperCase() === 'GET'
-    && String(operation.resource_type || '').toLowerCase() === 'db_meta'
-    && String(operation.path || operation.path_template || '') === '/api/db-meta'
-    && operation.destructive !== true) || null;
-}
+const CONNECTION_PROBE_OPERATION = 'getCurrentUserAPIKey';
+
+function findConnectionProbeOperation(result) {
+  const value = diagnosticData(result);
+  const items = value && Array.isArray(value.items) ? value.items : [];
+  return items.find((operation) => operation
+    && operation.operation_id === CONNECTION_PROBE_OPERATION
+    && String(operation.method || '').toUpperCase() === 'GET'
+    && String(operation.risk || '').toLowerCase() === 'low'
+    && operation.destructive !== true) || null;
+}
+
+function assertSafeConnectionProbe(description) {
+  const value = diagnosticData(description);
+  const operation = value && value.operation && typeof value.operation === 'object'
+    ? value.operation : value;
+  const properties = operation && operation.input_schema && operation.input_schema.properties || {};
+  const required = operation && operation.input_schema && operation.input_schema.required || [];
+  const inputKeys = Object.keys(properties).filter((key) => key !== 'confirm');
+  if (!operation || operation.operation_id !== CONNECTION_PROBE_OPERATION
+      || String(operation.method || '').toUpperCase() !== 'GET'
+      || String(operation.risk || '').toLowerCase() !== 'low'
+      || operation.destructive === true || required.length > 0 || inputKeys.length > 0) {
+    throw new McpRpcError(`DraftGo Registry does not expose a safe ${CONNECTION_PROBE_OPERATION} probe.`, {
+      code: -32601,
+    });
+  }
+  return operation;
+}
 
 class McpRpcError extends Error {
   constructor(message, { code = -32000, data, id = null } = {}) {
@@ -103,40 +130,6 @@ function sessionInvalidResponse(message, expectedIds) {
     && isSessionInvalidError(item.error)) || null;
 }
 
-function diagnosticNextCursor(result) {
-  const value = diagnosticData(result);
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
-  const hasMore = value.has_more === true || value.hasMore === true;
-
-  let cursor;
-  let present = false;
-  if (Object.prototype.hasOwnProperty.call(value, 'next_cursor')) {
-    cursor = value.next_cursor;
-    present = true;
-  } else if (Object.prototype.hasOwnProperty.call(value, 'nextCursor')) {
-    cursor = value.nextCursor;
-    present = true;
-  } else if (hasMore) {
-    if (!Object.prototype.hasOwnProperty.call(value, 'cursor')) {
-      throw new McpRpcError('DraftGo api_search reported more pages without a cursor.');
-    }
-    cursor = value.cursor;
-    present = true;
-  }
-
-  if (!present) return null;
-  if (cursor == null || cursor === '') {
-    if (hasMore) {
-      throw new McpRpcError('DraftGo api_search reported more pages with an empty cursor.');
-    }
-    return null;
-  }
-  if (typeof cursor !== 'string' || !cursor.trim()) {
-    throw new McpRpcError('DraftGo api_search returned an invalid cursor.');
-  }
-  return cursor;
-}
-
 function redactValue(value, secrets = [], seen = new WeakMap()) {
   if (typeof value === 'string') return redactText(value, secrets);
   if (!value || typeof value !== 'object') return value;
@@ -175,9 +168,10 @@ function findResponse(messages, id) {
     && !message.method);
 }
 
-function toolMatches(name, candidate) {
-  return name === candidate || name.endsWith(`.${candidate}`)
-    || name.endsWith(`/${candidate}`) || name.endsWith(`:${candidate}`);
+function toolMatches(name, candidate) {
+  const aliases = TOOL_ALIASES[candidate] || [candidate];
+  return aliases.some((alias) => name === alias || name.endsWith(`.${alias}`)
+    || name.endsWith(`/${alias}`) || name.endsWith(`:${alias}`));
 }
 
 class DraftGoMcpClient {
@@ -446,32 +440,20 @@ class DraftGoMcpClient {
       );
     }
 
-    const selected = safeTools.map((canonical) => ({
+    const selected = safeTools.map((canonical) => ({
       canonical,
       tool: tools.find((candidate) => candidate && typeof candidate.name === 'string'
         && toolMatches(candidate.name, canonical)),
     })).filter((entry) => entry.tool);
     const byCanonical = Object.fromEntries(selected.map((entry) => [entry.canonical, entry.tool]));
     const overrideCanonical = safeTools.find((canonical) => toolMatches(firstSafeTool.name, canonical));
-    let defaultPlan = hasDiagnosticOverrides ? [{
-      label: overrideCanonical,
-      canonical: overrideCanonical,
-      tool: firstSafeTool,
-      args: diagnosticArguments(overrideCanonical),
-    }] : [
-      { label: 'project', canonical: 'draftgo_project_overview', tool: byCanonical.draftgo_project_overview, args: {} },
-      ...['pages', 'navigations', 'docs/articles'].map((resourceType) => ({
-        label: `resource:${resourceType}`,
-        canonical: 'draftgo_resource_list',
-        tool: byCanonical.draftgo_resource_list,
-        args: { resource_type: resourceType, limit: 1 },
-      })),
-      {
-        label: 'api:db_meta',
-        canonical: 'draftgo_api_search',
-        tool: byCanonical.draftgo_api_search,
-        args: { resource_type: 'db_meta', limit: 100 },
-      },
+    const defaultPlan = hasDiagnosticOverrides ? [{
+      label: overrideCanonical,
+      canonical: overrideCanonical,
+      tool: firstSafeTool,
+      args: diagnosticArguments(overrideCanonical),
+    }] : [
+      { label: 'api:catalog', canonical: 'draftgo_api_search', tool: byCanonical.draftgo_api_search, args: { query: CONNECTION_PROBE_OPERATION, limit: 100 } },
     ];
     const runPlan = (plan, startIndex = 0) => allWithAbort(plan.map((entry, offset) =>
       async (queryOptions) => {
@@ -501,52 +483,34 @@ class DraftGoMcpClient {
       });
       }), options);
     const tested = await runPlan(defaultPlan);
-    if (!hasDiagnosticOverrides) {
-      let discovery = tested.find((entry) => entry.label === 'api:db_meta');
-      let operation = discovery && findDBMetaListOperation(discovery.result);
-      const seenCursors = new Set();
-      const maxPages = Number(options.maxPages || 100);
-      let page = 1;
-      while (!operation) {
-        const cursor = diagnosticNextCursor(discovery && discovery.result);
-        if (cursor == null) break;
-        if (seenCursors.has(cursor)) {
-          throw new McpRpcError('DraftGo api_search repeated a db_meta cursor.');
-        }
-        seenCursors.add(cursor);
-        if (page >= maxPages) {
-          throw new McpRpcError(`DraftGo api_search exceeded ${maxPages} db_meta pages.`);
-        }
-        page += 1;
-        [discovery] = await runPlan([{
-          label: `api:db_meta:page-${page}`,
-          canonical: 'draftgo_api_search',
-          tool: byCanonical.draftgo_api_search,
-          args: { resource_type: 'db_meta', limit: 100, cursor },
-        }], tested.length);
-        tested.push(discovery);
-        operation = findDBMetaListOperation(discovery.result);
-      }
-      if (!operation || !operation.operation_id) {
-        throw new McpRpcError('DraftGo MCP exposes no read-only GET /api/db-meta operation.', {
-          code: -32601,
-        });
-      }
-      const operationID = String(operation.operation_id);
-      tested.push(...await runPlan([
-        {
-          label: 'api:describe-db_meta',
-          canonical: 'draftgo_api_describe',
-          tool: byCanonical.draftgo_api_describe,
-          args: { operation_id: operationID },
-        },
-        {
-          label: 'api:call-db_meta',
-          canonical: 'draftgo_api_call',
-          tool: byCanonical.draftgo_api_call,
-          args: { operation_id: operationID, query: { page: 1, page_size: 1 } },
-        },
-      ], tested.length));
+    if (!hasDiagnosticOverrides) {
+      const discovery = tested.find((entry) => entry.label === 'api:catalog');
+      const catalog = diagnosticData(discovery && discovery.result);
+      const operation = findConnectionProbeOperation(discovery && discovery.result);
+      if (!operation || !operation.operation_id) {
+        throw new McpRpcError(`DraftGo Registry returned no safe ${CONNECTION_PROBE_OPERATION} operation.`, {
+          code: -32601,
+        });
+      }
+      const operationID = String(operation.operation_id);
+      const revision = String(catalog.registry_revision || '').trim();
+      if (!revision) {
+        throw new McpRpcError('DraftGo api_search did not return registry_revision.');
+      }
+      const [described] = await runPlan([{
+        label: 'api:describe',
+        canonical: 'draftgo_api_describe',
+        tool: byCanonical.draftgo_api_describe,
+        args: { operation_id: operationID, registry_revision: revision },
+      }], tested.length);
+      tested.push(described);
+      assertSafeConnectionProbe(described.result);
+      tested.push(...await runPlan([{
+        label: 'api:invoke',
+        canonical: 'draftgo_api_call',
+        tool: byCanonical.draftgo_api_call,
+        args: { operation_id: operationID, registry_revision: revision },
+      }], tested.length));
     }
     return {
       initialized,
@@ -580,11 +544,12 @@ module.exports = {
   McpRpcError,
   McpHttpError,
   SAFE_TEST_TOOLS,
-  REQUIRED_DRAFTGO_TOOLS,
+  REQUIRED_DRAFTGO_TOOLS,
+  TOOL_ALIASES,
   diagnosticArguments,
   diagnosticData,
-  diagnosticNextCursor,
-  findDBMetaListOperation,
+  findConnectionProbeOperation,
+  assertSafeConnectionProbe,
   isSessionInvalidError,
   redactValue,
   testConnection,

package/src/mcp/parallel.js

@@ -1,5 +1,24 @@
 'use strict';
 
+async function mapBounded(items, mapper, options = {}) {
+  const limit = options.concurrency ?? 8;
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 64) throw new TypeError('Concurrency must be between 1 and 64.');
+  const results = new Array(items.length);
+  let cursor = 0;
+  async function worker() {
+    while (cursor < items.length) {
+      const index = cursor++;
+      try { results[index] = { status: 'fulfilled', value: await mapper(items[index], index) }; }
+      catch (reason) { results[index] = { status: 'rejected', reason }; }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  if (options.settled) return results;
+  const failure = results.find((item) => item.status === 'rejected');
+  if (failure) throw failure.reason;
+  return results.map((item) => item.value);
+}
+
 async function allWithAbort(taskFactories, options = {}) {
   if (!Array.isArray(taskFactories) || taskFactories.some((task) => typeof task !== 'function')) {
     throw new TypeError('Parallel MCP tasks must be functions.');
@@ -19,7 +38,11 @@ async function allWithAbort(taskFactories, options = {}) {
   }
   try {
     const taskOptions = { ...options, signal: controller.signal };
-    return await Promise.all(taskFactories.map((task) => task(taskOptions)));
+    return await mapBounded(taskFactories, async (task) => {
+      controller.signal.throwIfAborted();
+      try { return await task(taskOptions); }
+      catch (error) { controller.abort(error); throw error; }
+    }, options);
   } catch (error) {
     if (!controller.signal.aborted) controller.abort(error);
     throw error;
@@ -28,4 +51,4 @@ async function allWithAbort(taskFactories, options = {}) {
   }
 }
 
-module.exports = { allWithAbort };
+module.exports = { allWithAbort, mapBounded };

package/src/mcp/protocol.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const DEFAULT_PROTOCOL_VERSION = '2026-07-28';
+const DEFAULT_MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 
 class McpHttpError extends Error {
   constructor(message, { status = 0, rpc = null, code = null } = {}) {
@@ -62,13 +63,14 @@ function routingHeaders(message) {
   return headers;
 }
 
-async function parseEventStream(body, onMessage) {
+async function parseEventStream(body, onMessage, maxBytes = DEFAULT_MAX_RESPONSE_BYTES) {
   if (!body) return [];
   const reader = body.getReader();
   const decoder = new TextDecoder();
   let pending = '';
   let dataLines = [];
-  const messages = [];
+  const messages = [];
+  let size = 0;
   const consume = () => {
     if (!dataLines.length) return;
     const data = dataLines.join('\n');
@@ -84,7 +86,12 @@ async function parseEventStream(body, onMessage) {
     }
   };
   while (true) {
-    const { done, value } = await reader.read();
+    const { done, value } = await reader.read();
+    size += value ? value.byteLength : 0;
+    if (size > maxBytes) {
+      await reader.cancel().catch(() => {});
+      throw new McpHttpError(`DraftGo MCP response exceeds ${maxBytes} bytes.`);
+    }
     pending += decoder.decode(value || new Uint8Array(), { stream: !done });
     const lines = pending.split(/\r?\n/);
     pending = lines.pop() || '';
@@ -99,7 +106,7 @@ async function parseEventStream(body, onMessage) {
   return messages;
 }
 
-async function readLimitedText(response, maxBytes = 65536) {
+async function readLimitedText(response, maxBytes = 65536) {
   if (!response.body) return '';
   const reader = response.body.getReader();
   const chunks = [];
@@ -112,7 +119,26 @@ async function readLimitedText(response, maxBytes = 65536) {
     size += chunk.length;
   }
   return Buffer.concat(chunks).toString('utf8');
-}
+}
+
+async function readBoundedText(response, maxBytes) {
+  if (!response.body) return '';
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    const chunk = Buffer.from(value);
+    size += chunk.length;
+    if (size > maxBytes) {
+      await reader.cancel().catch(() => {});
+      throw new McpHttpError(`DraftGo MCP response exceeds ${maxBytes} bytes.`);
+    }
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString('utf8');
+}
 
 async function postJsonRpc(config, message, options = {}) {
   const token = String(config.token || config.sat || '');
@@ -163,9 +189,11 @@ async function postJsonRpc(config, message, options = {}) {
     }
 
     if (contentType.includes('text/event-stream')) {
-      return await parseEventStream(response.body, options.onMessage);
-    }
-    const text = await response.text();
+      return await parseEventStream(response.body, options.onMessage,
+        Number(options.maxResponseBytes || config.mcp_max_response_bytes || DEFAULT_MAX_RESPONSE_BYTES));
+    }
+    const text = await readBoundedText(response,
+      Number(options.maxResponseBytes || config.mcp_max_response_bytes || DEFAULT_MAX_RESPONSE_BYTES));
     if (!text.trim()) return [];
     let parsed;
     try { parsed = JSON.parse(text); } catch {
@@ -183,7 +211,8 @@ async function postJsonRpc(config, message, options = {}) {
   }
 }
 
-module.exports = {
+module.exports = {
+  DEFAULT_MAX_RESPONSE_BYTES,
   DEFAULT_PROTOCOL_VERSION,
   McpHttpError,
   redactText,

package/src/mcp/tools.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { DraftGoMcpClient } = require('./client');
+const { DraftGoMcpClient, TOOL_ALIASES } = require('./client');
 const { WorktreeError } = require('../worktree/errors');
 const { unwrapToolResult, unwrapProtectedResult, toolNameMatches } = require('../worktree/backend');
 
@@ -15,6 +15,8 @@ const TOOL_NAMES = Object.freeze({
   apiCall: 'draftgo_api_call',
 });
 
+// Keep server-generation naming compatibility at the protocol boundary so
+// commands only deal with one canonical Registry contract.
 const PROTECTED_RESOURCE_TOOLS = new Set([
   TOOL_NAMES.resourceList,
   TOOL_NAMES.resourceSearch,
@@ -24,28 +26,17 @@ const PROTECTED_RESOURCE_TOOLS = new Set([
 
 async function openToolSession(config, expected = [], options = {}) {
   const client = options.client || new DraftGoMcpClient(config);
-  await client.initialize(options);
-  const tools = await client.listAllTools(options);
+  const initialized = options.clientInitialized ? null : await client.initialize(options);
+  const tools = options.tools || await client.listAllTools(options);
   const names = {};
   for (const expectedName of expected) {
-    const found = tools.find((tool) => tool && toolNameMatches(String(tool.name || ''), expectedName));
+    const aliases = TOOL_ALIASES[expectedName] || [expectedName];
+    const found = aliases.map((alias) => tools.find((tool) => tool
+      && toolNameMatches(String(tool.name || ''), alias))).find(Boolean);
     if (!found) throw new WorktreeError('MCP_TOOL_UNAVAILABLE', `${expectedName} is not available.`);
     names[expectedName] = found.name;
   }
-  return { client, tools, names };
-}
-
-function configuredScope(config, description = null) {
-  const operation = description && (description.operation || description) || {};
-  if (String(operation.ownership_mode || '').toLowerCase() === 'platform_only') return {};
-  const supported = Array.isArray(operation.supported_scopes)
-    ? operation.supported_scopes.map(value => String(value).toLowerCase()) : [];
-  const needsSpace = String(operation.ownership_mode || '').toLowerCase() === 'workspace_required'
-    && supported.length > 0 && !supported.includes('platform');
-  if (config && config.scope_type === 'space' && Number(config.space_id) > 0 && (needsSpace || supported.includes('space'))) {
-    return { scope_type: 'space', space_id: Number(config.space_id) };
-  }
-  return {};
+  return { client, initialized, tools, names };
 }
 
 async function callStructured(session, expectedName, args = {}, options = {}) {
@@ -57,4 +48,4 @@ async function callStructured(session, expectedName, args = {}, options = {}) {
     : data;
 }
 
-module.exports = { TOOL_NAMES, openToolSession, callStructured, configuredScope };
+module.exports = { TOOL_NAMES, TOOL_ALIASES, openToolSession, callStructured };

package/src/projectConfig.js

@@ -100,13 +100,10 @@ function writeProjectConfig(projectDir, server, token, options = {}) {
   if (!apiKey) throw new Error('DraftGo API Key is required.');
   const existing = readExisting(projectDir);
   const config = {
-    ...existing,
     server: normalizedServer,
     token: apiKey,
     auto_push: existing.auto_push === true,
   };
-  if (options.scope_type) config.scope_type = String(options.scope_type).trim().toLowerCase();
-  if (options.space_id) config.space_id = Number(options.space_id);
   if (options.mcp_url) config.mcp_url = normalizeMcpEndpoint(options.mcp_url);
   else delete config.mcp_url;
   const file = configPath(projectDir);
@@ -124,7 +121,7 @@ function loadProjectConfig(projectDir, { requireToken = true } = {}) {
   const token = String(config.token || config.sat || '').trim();
   if (!server) throw new Error('DraftGo project config is missing server.');
   if (requireToken && !token) throw new Error('DraftGo project config is missing API Key.');
-  const result = { ...config, server, token, path: file };
+  const result = { server, token, auto_push: config.auto_push === true, path: file };
   if (mcpUrl) result.mcp_url = mcpUrl;
   else delete result.mcp_url;
   return result;

package/src/{workspaceHealth.js → projectHealth.js}

@@ -5,7 +5,7 @@ const path = require('path');
 const runtime = require('./runtimeFiles');
 
 const PROTECTED_PREFIXES = ['worktree/', 'conflicts/', 'lessons/', 'tmp/', 'config.json', 'api-contract-cache.json', 'api-contract-cache.json.lock', 'worklog.md', 'story.yaml', '.version', 'runtime-manifest.json'];
-function workspaceHealth(projectDir) {
+function projectHealth(projectDir) {
   const root = runtime.draftgoRoot(projectDir); const registered = new Set(runtime.load(projectDir).entries.map((entry) => String(entry.path).replace(/\\/g, '/')));
   const summary = { managed_files: 0, unknown_files: 0, temporary_files: 0, artifact_files: 0, total_bytes: 0, reclaimable_bytes: 0, warnings: [] };
   if (!fs.existsSync(root)) return summary;
@@ -13,7 +13,7 @@ function workspaceHealth(projectDir) {
     for (const item of fs.readdirSync(directory, { withFileTypes: true })) {
       const absolute = path.join(directory, item.name); const relative = path.relative(root, absolute).replace(/\\/g, '/');
       if (item.isDirectory()) {
-        if ((/^(.+\/)?(build|dist|node_modules|tmp-build|build-)/i.test(relative)) && directorySize(absolute) > 50 * 1024 * 1024) summary.warnings.push({ code: 'DG-WORKSPACE-LARGE-BUILD', path: relative });
+        if ((/^(.+\/)?(build|dist|node_modules|tmp-build|build-)/i.test(relative)) && directorySize(absolute) > 50 * 1024 * 1024) summary.warnings.push({ code: 'DG-PROJECT-LARGE-BUILD', path: relative });
         visit(absolute); continue;
       }
       if (!item.isFile()) continue;
@@ -23,11 +23,11 @@ function workspaceHealth(projectDir) {
       if (relative.startsWith('tmp/')) summary.temporary_files += 1;
       if (relative.startsWith('artifacts/')) summary.artifact_files += 1;
       if (registered.has(relative) || relative.startsWith('tmp/')) summary.reclaimable_bytes += size;
-      if (!managed && (/\.exe$/i.test(relative) || (/^[^/]+\.(go|json)$/i.test(relative) && !['config.json', 'runtime-manifest.json'].includes(relative)))) summary.warnings.push({ code: 'DG-WORKSPACE-UNKNOWN-FILE', path: relative, size });
-      if (relative.startsWith('artifacts/') && !registered.has(relative)) summary.warnings.push({ code: 'DG-WORKSPACE-UNREGISTERED-ARTIFACT', path: relative, size });
+      if (!managed && (/\.exe$/i.test(relative) || (/^[^/]+\.(go|json)$/i.test(relative) && !['config.json', 'runtime-manifest.json'].includes(relative)))) summary.warnings.push({ code: 'DG-PROJECT-UNKNOWN-FILE', path: relative, size });
+      if (relative.startsWith('artifacts/') && !registered.has(relative)) summary.warnings.push({ code: 'DG-PROJECT-UNREGISTERED-ARTIFACT', path: relative, size });
     }
   };
   visit(root); return summary;
 }
 function directorySize(directory) { let total = 0; const visit = (current) => { for (const item of fs.readdirSync(current, { withFileTypes: true })) { const absolute = path.join(current, item.name); if (item.isDirectory()) visit(absolute); else if (item.isFile()) total += fs.statSync(absolute).size; if (total > 50 * 1024 * 1024) return; } }; visit(directory); return total; }
-module.exports = { workspaceHealth };
+module.exports = { projectHealth };

package/src/projectMap.js

@@ -110,7 +110,7 @@ function buildProjectMap(projectDir) {
     docs,
     pageGroups: collectGroups(pages),
     routeRefs: Object.fromEntries([...routeRefs].map(([route, sources]) => [route, [...sources]])),
-    remote_only: ['db_meta', 'aihub', 'system_config', 'roles', 'users', 'doc_categories', 'custom_services'],
+    remote_only: ['db_meta', 'models', 'prompts', 'plugins', 'knowledge', 'memory', 'agents', 'custom_services', 'system_config', 'roles', 'users', 'doc_categories'],
   };
 }
 

package/src/runtimeFiles.js

@@ -8,7 +8,7 @@ const RETRYABLE_RENAME_CODES = new Set(['EPERM', 'EBUSY', 'EACCES']);
 const sleepBuffer = new Int32Array(new SharedArrayBuffer(4));
 function draftgoRoot(projectDir) { return path.resolve(projectDir, '.draftgo'); }
 function manifestPath(projectDir) { return path.join(draftgoRoot(projectDir), 'runtime-manifest.json'); }
-function inside(root, target) { const relation = path.relative(root, target); return relation && !relation.startsWith('..') && !path.isAbsolute(relation); }
+function inside(root, target) { const relation = path.relative(path.resolve(root), path.resolve(target)); return relation && !relation.startsWith('..') && !path.isAbsolute(relation); }
 function load(projectDir) {
   const file = manifestPath(projectDir);
   if (!fs.existsSync(file)) return { schema_version: SCHEMA_VERSION, entries: [] };
@@ -36,6 +36,7 @@ function save(projectDir, value) {
 function register(projectDir, file, type, command, options = {}) {
   const root = draftgoRoot(projectDir); const absolute = path.resolve(file);
   if (!inside(root, absolute)) throw new Error('Managed runtime files must stay inside .draftgo.');
+  if (fs.existsSync(absolute) && !inside(fs.realpathSync(root), fs.realpathSync(absolute))) throw new Error('Managed runtime file escapes .draftgo.');
   const relative = path.relative(root, absolute).replace(/\\/g, '/'); const value = load(projectDir);
   const entry = { path: relative, type: String(type), command: String(command), created_at: new Date().toISOString(), cleanable: options.cleanable !== false };
   value.entries = value.entries.filter((item) => item.path !== relative); value.entries.push(entry); save(projectDir, value); return entry;

package/src/worklog.js

@@ -5,7 +5,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { dgDir } = require('./paths');
 
-const STATUS = Object.freeze({ pending: '', active: '●', completed: '√' });
+const STATUS = Object.freeze({ pending: '', active: '●', waiting: '?', completed: '√' });
 const LOCK_WAIT_ARRAY = new Int32Array(new SharedArrayBuffer(4));
 
 function formatLocalDate(value = new Date()) {
@@ -47,6 +47,7 @@ function normalizeDate(value, now = new Date()) {
 function parseStatus(marker) {
   if (marker === '●') return 'active';
   if (marker === '√') return 'completed';
+  if (marker === '?') return 'waiting';
   if (marker === '') return 'pending';
   throw invalid(`unsupported status marker ${JSON.stringify(marker)}.`);
 }
@@ -72,7 +73,7 @@ function parseWorklog(source) {
     cursor += 1;
     const entries = [];
     while (cursor < lines.length && lines[cursor] !== '') {
-      const itemMatch = /^([1-9]\d*)\.\s+\[\s*(●|√)?\s*\]\s+(.+)$/.exec(lines[cursor]);
+      const itemMatch = /^([1-9]\d*)\.\s+\[\s*(●|√|\?)?\s*\]\s+(.+)$/.exec(lines[cursor]);
       if (!itemMatch) throw invalid(`invalid item at line ${cursor + 1}.`);
       const number = Number(itemMatch[1]);
       if (!Number.isSafeInteger(number) || number !== entries.length + 1) {