lurqrun 0.1.7 → 0.1.8

package/dist/{check-2FDGUOV7.js → check-PQSQ2MMA.js}

@@ -1,7 +1,7 @@
 import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
 import {
   checkApi
-} from "./chunk-CIDWNUAP.js";
+} from "./chunk-SOXFMMXC.js";
 import {
   require_dist
 } from "./chunk-QKGYDMWB.js";

package/dist/checkUpgrade-5YW77OBL.js

@@ -0,0 +1,24 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  SCAN_LIMIT,
+  fixableTargets,
+  modeDisagreement,
+  parseUpgradeSpec,
+  planMode,
+  planUpgrades,
+  runCheckUpgrade,
+  targetsFromPlanFile,
+  targetsFromUpgrades
+} from "./chunk-QCRBX3LV.js";
+import "./chunk-I3M2KJXB.js";
+export {
+  SCAN_LIMIT,
+  fixableTargets,
+  modeDisagreement,
+  parseUpgradeSpec,
+  planMode,
+  planUpgrades,
+  runCheckUpgrade,
+  targetsFromPlanFile,
+  targetsFromUpgrades
+};

package/dist/{chunk-BCANRN5B.js → chunk-2GAYNIHG.js}

@@ -8,8 +8,14 @@ init_esm_shims();
 var DEFAULT_REPO_POLICY = {
   enabled: false,
   scope: "blocking",
-  autoMerge: false
+  autoMerge: false,
+  // Stated rather than relied upon. `permits()` already reads an absent
+  // `checks` as on, so a repo connected before this shipped behaves the same as
+  // a new one — which is the point of the inversion. Writing it here keeps the
+  // default visible in the policy the dashboard round-trips.
+  checks: { env: true }
 };
+var RUN_TRIGGERS = ["schedule", "dispatch", "push", "pull_request", "other"];
 var UPGRADE_SEVERITIES = ["blocking", "warning", "ok", "unverified"];
 var UPGRADE_RUN_STATUSES = [
   "checked",
@@ -25,6 +31,7 @@ var TRANSITIVE_DETAIL_CAP = 100;
 
 export {
   DEFAULT_REPO_POLICY,
+  RUN_TRIGGERS,
   UPGRADE_SEVERITIES,
   UPGRADE_RUN_STATUSES,
   REPO_MANIFEST_CAP,

package/dist/{chunk-EA3DP5HG.js → chunk-2O6Z37IT.js}

@@ -1,10 +1,4 @@
 import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
-import {
-  MissingKeyError
-} from "./chunk-4ZYCIMY4.js";
-import {
-  openInBrowser
-} from "./chunk-TNTXWSYA.js";
 import {
   bold,
   dim,
@@ -18,18 +12,24 @@ import {
   lurqInvocation,
   printInstallReport,
   resolveAgents
-} from "./chunk-UDVNA7EA.js";
+} from "./chunk-DM37MTOO.js";
+import {
+  MissingKeyError
+} from "./chunk-OTJFHESY.js";
 import {
   readUserConfig,
   resolveApiKey,
   resolveEndpoint,
   writeUserConfig
-} from "./chunk-Y5GI7RL3.js";
+} from "./chunk-J6XQ7OPZ.js";
+import {
+  openInBrowser
+} from "./chunk-TNTXWSYA.js";
 import {
   DEFAULT_ENDPOINT,
   KEYS_URL,
   PACKAGE_NAME
-} from "./chunk-GPTKSNR6.js";
+} from "./chunk-72Y2FDVS.js";
 import {
   init_esm_shims
 } from "./chunk-I3M2KJXB.js";
@@ -37,6 +37,50 @@ import {
 // src/cli/install.ts
 init_esm_shims();
 import { spawnSync } from "child_process";
+
+// src/cli/agentLink.ts
+init_esm_shims();
+import { spawn } from "child_process";
+var LINK_PREFIX = "LURQ_SIGNIN ";
+var LINK_WAIT_MS = 15 * 6e4;
+var START_TIMEOUT_MS = 15e3;
+function setupMode(o) {
+  if (o.yes) return o.hasKey ? "non-interactive" : "needs-key";
+  if (o.tty) return "interactive";
+  if (o.hasKey) return "non-interactive";
+  return o.ci || o.selfHosted ? "needs-key" : "agent-link";
+}
+function startAgentLink(opts, spawnImpl = spawn) {
+  const args = [...process.execArgv, process.argv[1] ?? "", "setup", "--wait-for-signin"];
+  if (opts.agent) args.push("--agent", opts.agent);
+  if (opts.noOpen) args.push("--no-open");
+  const child = spawnImpl(process.execPath, args, {
+    detached: true,
+    stdio: ["ignore", "pipe", "ignore"],
+    // The link has to be the first thing it prints; an update notice first would only be noise.
+    env: { ...process.env, NO_UPDATE_NOTIFIER: "1" }
+  });
+  return new Promise((resolve) => {
+    let buffered = "";
+    const done = (link) => {
+      clearTimeout(timer);
+      child.stdout?.removeAllListeners("data");
+      child.stdout?.destroy();
+      child.unref();
+      resolve(link);
+    };
+    const timer = setTimeout(() => done(null), START_TIMEOUT_MS);
+    child.stdout?.on("data", (chunk) => {
+      buffered += chunk.toString();
+      const line = buffered.split("\n").find((l) => l.startsWith(LINK_PREFIX));
+      if (line) done(line.slice(LINK_PREFIX.length).trim());
+    });
+    child.once("error", () => done(null));
+    child.once("exit", () => done(null));
+  });
+}
+
+// src/cli/install.ts
 async function withSetupOnMissingKey(run, ask = askToConnect, setup = () => runSetup({})) {
   try {
     await run();
@@ -50,7 +94,10 @@ async function askToConnect() {
   const interactive = process.stdin.isTTY && process.stdout.isTTY && !process.env.CI && !process.argv.includes("--json");
   if (!interactive) return false;
   const { confirm } = await import("./dist-4XXIXHHZ.js");
-  return confirm({ message: "This machine has no lurq API key yet. Connect it now?", default: true });
+  return confirm({
+    message: "This machine has no lurq API key yet. Connect it now?",
+    default: true
+  });
 }
 async function validateKey(url, apiKey) {
   try {
@@ -91,20 +138,31 @@ function installGlobally() {
   console.log(yellow("skipped"));
   const reason = (res.stderr || res.error?.message || "").trim().split("\n").pop();
   if (reason) console.log(dim(`  ${reason}`));
-  console.log(dim(`  Setup continues. Run \`npm install -g ${PACKAGE_NAME}\` later if you want it.`));
+  console.log(
+    dim(`  Setup continues. Run \`npm install -g ${PACKAGE_NAME}\` later if you want it.`)
+  );
 }
 async function runSetup(opts) {
-  const interactive = !opts.yes;
-  if (interactive && !(process.stdin.isTTY && process.stdout.isTTY)) {
+  if (opts.waitForSignin) return waitForSigninAndFinish(opts);
+  const url = resolveEndpoint(opts.url) ?? DEFAULT_ENDPOINT;
+  let apiKey = resolveApiKey(opts.apiKey);
+  const selfHosted = url !== DEFAULT_ENDPOINT;
+  const mode = setupMode({
+    yes: Boolean(opts.yes),
+    tty: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    ci: Boolean(process.env.CI),
+    hasKey: Boolean(apiKey),
+    selfHosted
+  });
+  if (mode === "agent-link") return runAgentLink(opts);
+  if (mode === "needs-key" && !opts.yes) {
     throw new Error(
       `lurq setup asks questions, and this is not an interactive terminal (CI, a pipe, or an agent shell).
 Run it non-interactively:  npx ${PACKAGE_NAME} setup --yes --api-key <key>
 Get a key at ${KEYS_URL}`
     );
   }
-  const url = resolveEndpoint(opts.url) ?? DEFAULT_ENDPOINT;
-  let apiKey = resolveApiKey(opts.apiKey);
-  const selfHosted = url !== DEFAULT_ENDPOINT;
+  const interactive = mode === "interactive";
   if (interactive) {
     const { input, checkbox, confirm, select } = await import("./dist-4XXIXHHZ.js");
     console.log(`
@@ -129,7 +187,7 @@ Get a key at ${KEYS_URL}`
       if (!reuse) apiKey = void 0;
     }
     if (!apiKey && !selfHosted) {
-      const { keyViaBrowser } = await import("./browserAuth-B6G27USY.js");
+      const { keyViaBrowser } = await import("./browserAuth-J7APSD4P.js");
       console.log("  Sign in and this machine gets its key. Nothing to copy.\n");
       process.stdout.write("  Waiting for the browser\u2026 ");
       const skip = new AbortController();
@@ -138,6 +196,7 @@ Get a key at ${KEYS_URL}`
       const handoff = await keyViaBrowser({
         noOpen: opts.noOpen,
         signal: skip.signal,
+        via: "terminal",
         // Printed rather than only opened: the browser may not have launched,
         // and a spinner pointing at a URL nobody can see is a hung flow.
         onUrl: (link) => console.log(`
@@ -235,7 +294,10 @@ Get a key at ${KEYS_URL}`
         checked: s.detected
       }))
     });
-    await finish(specs.filter((s) => ids.includes(s.id)), { url, apiKey });
+    await finish(
+      specs.filter((s) => ids.includes(s.id)),
+      { url, apiKey }
+    );
     return;
   }
   if (!apiKey) {
@@ -257,6 +319,46 @@ Get a key at ${KEYS_URL}`
   const selected = opts.agent ? resolveAgents(opts.agent) : agentSpecs().filter((s) => s.detected);
   await finish(selected, { url, apiKey });
 }
+async function runAgentLink(opts) {
+  const link = await startAgentLink({ agent: opts.agent, noOpen: opts.noOpen });
+  if (!link) {
+    throw new Error(
+      `Could not start the sign-in listener on this machine.
+Run it non-interactively instead:  npx ${PACKAGE_NAME} setup --yes --api-key <key>
+Get a key at ${KEYS_URL}`
+    );
+  }
+  const selected = opts.agent ? resolveAgents(opts.agent) : agentSpecs().filter((s) => s.detected);
+  console.log(
+    "lurq needs a one-time sign-in to connect this machine. Open this link on this computer:\n"
+  );
+  console.log(`  ${link}
+`);
+  console.log(
+    `Signing in finishes setup by itself: the key is stored${selected.length ? ` and lurq is connected to ${selected.map((s) => s.label).join(", ")}` : " for the lurq CLI (no coding agents detected)"}. The link works for ${LINK_WAIT_MS / 6e4} minutes.`
+  );
+  console.log("Afterwards, restart your coding agent so it loads lurq.");
+}
+async function waitForSigninAndFinish(opts) {
+  process.stdout.on("error", () => {
+  });
+  const { keyViaBrowser } = await import("./browserAuth-J7APSD4P.js");
+  const handoff = await keyViaBrowser({
+    noOpen: opts.noOpen,
+    deadlineMs: LINK_WAIT_MS,
+    via: "agent",
+    onUrl: (link) => {
+      process.stdout.write(`${LINK_PREFIX}${link}
+`);
+      console.log = () => {
+      };
+    }
+  });
+  if (!handoff) return;
+  if (await validateKey(DEFAULT_ENDPOINT, handoff.key) !== "valid") return;
+  const selected = opts.agent ? resolveAgents(opts.agent) : agentSpecs().filter((s) => s.detected);
+  await finish(selected, { url: DEFAULT_ENDPOINT, apiKey: handoff.key });
+}
 async function finish(selected, remote) {
   const configPath = writeUserConfig({
     apiKey: remote.apiKey,
@@ -271,19 +373,47 @@ ${green("\u2713")} API key saved to ${configPath} ${dim("(mode 0600)")}`);
   );
   const { command } = lurqInvocation();
   console.log(
-    dim(`  \`${command} verify <package>\`, \`evaluate\`, \`compare\`, \`usage\` now work anywhere.`)
+    dim(
+      `  \`${command} verify <package>\`, \`evaluate\`, \`compare\`, \`usage\` now work anywhere.`
+    )
   );
   if (selected.length === 0) {
     console.log(
       "\nNo agents selected or detected. Re-run `lurq setup --agent <id>` once your assistant is installed."
     );
-    return;
+  } else {
+    const mode = { kind: "remote", ...remote };
+    const results = selected.map((s) => installAgent(s, mode));
+    const instructionsPath = installInstructionsFile();
+    console.log("");
+    printInstallReport(results, instructionsPath, mode);
+  }
+  await printFirstScan(remote);
+}
+var FIRST_SCAN_TIMEOUT_MS = 15e3;
+async function printFirstScan(remote) {
+  try {
+    const { buildUpgradePlan, planHeadline, scanSourceDrift } = await import("./upgradePlan-ZS5IOVMZ.js");
+    const [plan, source] = await Promise.all([
+      buildUpgradePlan(process.cwd(), {
+        url: remote.url,
+        apiKey: remote.apiKey,
+        timeoutMs: FIRST_SCAN_TIMEOUT_MS
+      }),
+      scanSourceDrift(process.cwd())
+    ]);
+    const headline = planHeadline(plan, source);
+    if (!headline) return;
+    const { command } = lurqInvocation();
+    console.log(`
+${yellow("!")} ${bold("In this project right now:")} ${headline}`);
+    console.log(
+      dim(
+        `  \`${command} upgrade-plan\` for the list, \`${command} fix\` to write the changes that need no judgement.`
+      )
+    );
+  } catch {
   }
-  const mode = { kind: "remote", ...remote };
-  const results = selected.map((s) => installAgent(s, mode));
-  const instructionsPath = installInstructionsFile();
-  console.log("");
-  printInstallReport(results, instructionsPath, mode);
 }
 
 export {

package/dist/{chunk-J5FZYN4A.js → chunk-2WD4QAH4.js}

@@ -1,7 +1,7 @@
 import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
 import {
   stackResolutions
-} from "./chunk-LYMPYETA.js";
+} from "./chunk-4JHDSVIN.js";
 import {
   getConfig
 } from "./chunk-GRJXQBQZ.js";

package/dist/{chunk-CUP36ND3.js → chunk-3676XOBU.js}

@@ -1,11 +1,25 @@
 import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
 import {
   handleAudit
-} from "./chunk-IQ4SDKKY.js";
+} from "./chunk-B2UUYRBX.js";
+import {
+  ReadBuffer,
+  serializeMessage
+} from "./chunk-NEZNAPPN.js";
+import {
+  searchCapabilities
+} from "./chunk-KP5ZDDPE.js";
+import {
+  handleMcpDrift,
+  handleMcpSurface
+} from "./chunk-BN3NM47Q.js";
+import {
+  handleDiffSurface,
+  handleResolveSurface
+} from "./chunk-BJT2LHAR.js";
 import {
   AjvJsonSchemaValidator,
   Protocol,
-  ReadBuffer,
   assertClientRequestTaskCapability,
   assertToolsCallTaskCapability,
   getLiteralValue,
@@ -19,20 +33,8 @@ import {
   objectFromShape,
   safeParse,
   safeParseAsync,
-  serializeMessage,
   toJsonSchemaCompat
-} from "./chunk-XBIDMHSK.js";
-import {
-  searchCapabilities
-} from "./chunk-L6N4JFW2.js";
-import {
-  handleMcpDrift,
-  handleMcpSurface
-} from "./chunk-3N3Q3DSW.js";
-import {
-  handleDiffSurface,
-  handleResolveSurface
-} from "./chunk-DB2VF5UD.js";
+} from "./chunk-XLXPVN3Y.js";
 import {
   CallToolRequestSchema,
   CallToolResultSchema,
@@ -59,10 +61,10 @@ import {
   SetLevelRequestSchema,
   assertCompleteRequestPrompt,
   assertCompleteRequestResourceTemplate
-} from "./chunk-6AAEVQ7I.js";
+} from "./chunk-D3K6IZVR.js";
 import {
   handleDiagram
-} from "./chunk-4F7ZESPO.js";
+} from "./chunk-EQCXENKZ.js";
 import {
   handleCompare,
   handleCompat,
@@ -71,13 +73,13 @@ import {
   handleReportOutcome,
   handleUsage,
   handleVerify
-} from "./chunk-BULZAX2U.js";
+} from "./chunk-64ZF7KO4.js";
 import {
   createDb
-} from "./chunk-WQ23REYT.js";
+} from "./chunk-VGCDRK3S.js";
 import {
   ownerUsageDaily
-} from "./chunk-LYMPYETA.js";
+} from "./chunk-4JHDSVIN.js";
 import {
   require_semver
 } from "./chunk-3GHJR7XR.js";
@@ -94,7 +96,7 @@ import {
 import {
   SERVER_NAME,
   VERSION
-} from "./chunk-GPTKSNR6.js";
+} from "./chunk-72Y2FDVS.js";
 import {
   __toESM,
   init_esm_shims
@@ -1654,6 +1656,32 @@ var StdioServerTransport = class {
 // src/mcp/server.ts
 var import_semver = __toESM(require_semver(), 1);
 
+// src/clients/types.ts
+init_esm_shims();
+var CLIENT_IDS = [
+  "claude-code",
+  "claude-desktop",
+  "claude-ai",
+  "claude-api",
+  "chatgpt",
+  "openai-responses",
+  "codex",
+  "gemini-cli",
+  "cursor",
+  "vscode",
+  "windsurf",
+  "zed",
+  "jetbrains-ai",
+  "junie",
+  "cline",
+  "continue",
+  "goose",
+  "lovable",
+  "replit",
+  "bolt",
+  "v0"
+];
+
 // src/mcp/metrics.ts
 init_esm_shims();
 var stats = /* @__PURE__ */ new Map();
@@ -1754,12 +1782,7 @@ async function getUsageByTool(db, ownerId, days) {
   const rows = await db.select({
     tool: ownerUsageDaily.tool,
     count: sql`sum(${ownerUsageDaily.count})::int`
-  }).from(ownerUsageDaily).where(
-    and(
-      eq(ownerUsageDaily.ownerId, ownerId),
-      gte(ownerUsageDaily.date, windowStart(days))
-    )
-  ).groupBy(ownerUsageDaily.tool).orderBy(desc(sql`sum(${ownerUsageDaily.count})`));
+  }).from(ownerUsageDaily).where(and(eq(ownerUsageDaily.ownerId, ownerId), gte(ownerUsageDaily.date, windowStart(days)))).groupBy(ownerUsageDaily.tool).orderBy(desc(sql`sum(${ownerUsageDaily.count})`));
   return rows.map((r) => ({ tool: r.tool, count: Number(r.count) }));
 }
 
@@ -1800,7 +1823,8 @@ async function flush() {
       body: JSON.stringify({ api_key: key, batch }),
       signal: AbortSignal.timeout(5e3)
     });
-    if (!res.ok) logger.warn(`posthog batch rejected (${res.status}), dropped ${batch.length} event(s)`);
+    if (!res.ok)
+      logger.warn(`posthog batch rejected (${res.status}), dropped ${batch.length} event(s)`);
   } catch (err) {
     logger.warn("posthog batch failed:", err instanceof Error ? err.message : String(err));
   }
@@ -1834,7 +1858,7 @@ function buildMcpServer(db, ctx = {}) {
       return result;
     } finally {
       void recordUsage(db, ctx.ownerId ?? null, tool);
-      capture(ctx.ownerId, "tool_called", { tool, ok });
+      capture(ctx.ownerId, "tool_called", { tool, ok, client: ctx.client ?? null });
     }
   })();
   const reply = (obj) => {
@@ -1900,7 +1924,12 @@ function buildMcpServer(db, ctx = {}) {
         package: npmName.describe("npm package name to verify")
       }
     },
-    async (args) => reply(await run("verify", () => handleVerify(db, args, ctx.ownerId ?? null)))
+    async (args) => {
+      const result = await run("verify", () => handleVerify(db, args, ctx.ownerId ?? null));
+      const usable = result.exists && result.verdict.level !== "invalid" && result.verdict.level !== "high";
+      const next = `Before writing code against ${args.package}, call usage with it (and knownVersion if you remember one): its API may have moved since your training.`;
+      return reply(usable ? { ...result, next } : result);
+    }
   );
   server.registerTool(
     "usage",
@@ -1955,7 +1984,21 @@ function buildMcpServer(db, ctx = {}) {
         toVersion: external_exports.string().describe("Version you are moving to")
       }
     },
-    async (args) => reply(await run("diff_surface", () => handleDiffSurface(db, args)))
+    async (args) => reply(
+      await run("diff_surface", async () => {
+        const diff = await handleDiffSurface(db, args);
+        if (diff.verdict === "unknown") return diff;
+        const { upgradeGuideFor } = await import("./publicUpgrades-WTBGLDIK.js");
+        const guide = await upgradeGuideFor(
+          db,
+          args.package,
+          args.fromVersion,
+          args.toVersion,
+          getConfig().LURQ_WEB_URL
+        ).catch(() => null);
+        return guide ? { ...diff, upgradeGuide: guide } : diff;
+      })
+    )
   );
   server.registerTool(
     "mcp_stack",
@@ -1966,14 +2009,18 @@ function buildMcpServer(db, ctx = {}) {
       inputSchema: {
         servers: external_exports.array(
           external_exports.object({
-            server: external_exports.string().trim().min(1).max(300).describe("npm package name of the MCP server, or any label when `tools` is given"),
+            server: external_exports.string().trim().min(1).max(300).describe(
+              "npm package name of the MCP server, or any label when `tools` is given"
+            ),
             version: external_exports.string().max(100).nullable().optional(),
             tools: external_exports.array(
               external_exports.object({
                 name: external_exports.string().min(1).max(256),
                 annotations: external_exports.record(external_exports.unknown()).optional()
               })
-            ).max(2e3).optional().describe("The tool list as the agent received it; names and annotations are enough")
+            ).max(2e3).optional().describe(
+              "The tool list as the agent received it; names and annotations are enough"
+            )
           }).refine((s) => s.tools !== void 0 || npmName.safeParse(s.server).success, {
             message: "server must be an npm package name unless tools are given"
           })
@@ -1982,7 +2029,7 @@ function buildMcpServer(db, ctx = {}) {
     },
     async (args) => reply(
       await run("mcp_stack", async () => {
-        const { checkMcpStack } = await import("./mcpStack-BYJCZNIV.js");
+        const { checkMcpStack } = await import("./mcpStack-ZNYIFXZ5.js");
         return checkMcpStack(
           db,
           args.servers.map((s) => ({
@@ -2021,6 +2068,66 @@ function buildMcpServer(db, ctx = {}) {
     },
     async (args) => reply(await run("mcp_drift", () => handleMcpDrift(db, args)))
   );
+  server.registerTool(
+    "connect_check",
+    {
+      title: "Will this MCP server work in my client?",
+      description: "Before wiring an MCP server into a client, find out whether it will work there and exactly what it takes. Accepts an endpoint URL, an official-registry server name, or an npm package name. Answers per client (Claude Code, Claude.ai, ChatGPT, Cursor, VS Code, Codex, Gemini CLI and more): WORKS; NEEDS_SETUP with the steps (a key to send as a header, an OAuth client to pre-register and the redirect URIs to allow, a URL placeholder to fill); BLOCKED with the reason and which side causes it; or UNKNOWN when a decisive fact is not established. Built from a credential-free probe of the endpoint (whether it answers, how it authenticates, which OAuth registration methods it offers, spec deviations strict clients refuse, tool names and schemas) and from primary-sourced client constraints. Returns ready-to-paste config in each client's own format, with placeholder values. Tell the user what it found, including which client it was checked for. UNKNOWN never means it will not work.",
+      annotations: READ_LIVE,
+      inputSchema: {
+        server: external_exports.string().trim().min(1).max(2048).describe(
+          "Endpoint URL (https://\u2026), official registry name (io.github.acme/weather), or npm package name"
+        ),
+        client: external_exports.enum(CLIENT_IDS).optional().describe(
+          "One client to check, e.g. claude-code, cursor, chatgpt; omit for every client"
+        )
+      }
+    },
+    async (args) => reply(
+      await run("connect_check", async () => {
+        const [{ handleConnectCheck }, { sharedSafeFetch }] = await Promise.all([
+          import("./check-2JTQDQA6.js"),
+          import("./safeFetch-COERXGFN.js")
+        ]);
+        return handleConnectCheck(
+          db,
+          { server: args.server, client: args.client ?? null },
+          { liveProbe: { fetch: sharedSafeFetch() } }
+        );
+      })
+    )
+  );
+  if (ctx.local) {
+    server.registerTool(
+      "upkeep",
+      {
+        title: "What needs fixing in this project",
+        description: "The upkeep plan for the project you are editing, read from its own files. Returns findings across domains: environment variables the code reads that no .env file declares, model identifiers the provider has retired or put an end date on, and \u2014 when you pass `upgrade` \u2014 the call sites an upgrade breaks, the replacement the package itself proves, and the manifest ranges left stale. Each finding carries either exact edits (a rename the package proves, byte ranges you can apply) or a brief with the facts you cannot look up: the exports the target version actually ships, with their kinds and arities. A domain that could not run says so; a skipped domain is never the same as a clean one. Needs no API key. Use it before editing a project you have just opened, or after an upgrade to see what it broke.",
+        annotations: READ_LIVE,
+        inputSchema: {
+          dir: external_exports.string().max(4096).optional().describe(
+            "Project root. Defaults to the working directory this server was started in."
+          ),
+          upgrade: external_exports.array(
+            external_exports.object({
+              package: npmName,
+              fromVersion: external_exports.string().min(1).max(100),
+              toVersion: external_exports.string().min(1).max(100)
+            })
+          ).max(50).optional().describe(
+            "Upgrades to assess. Without this the package domain is skipped, because working out what moved needs the index and this tool runs without a key."
+          ),
+          domains: external_exports.array(external_exports.enum(["package", "mcp-config", "env", "api", "model"])).max(5).optional().describe("Limit to these domains. Default: every domain with a detector.")
+        }
+      },
+      async (args) => reply(
+        await run("upkeep", async () => {
+          const { handleUpkeep } = await import("./upkeepHandler-VFGYXJKB.js");
+          return handleUpkeep(args);
+        })
+      )
+    );
+  }
   server.registerTool(
     "audit",
     {
@@ -2088,7 +2195,9 @@ function buildMcpServer(db, ctx = {}) {
   );
   server.server.registerCapabilities({ resources: {}, prompts: {} });
   server.server.setRequestHandler(ListResourcesRequestSchema, () => ({ resources: [] }));
-  server.server.setRequestHandler(ListResourceTemplatesRequestSchema, () => ({ resourceTemplates: [] }));
+  server.server.setRequestHandler(ListResourceTemplatesRequestSchema, () => ({
+    resourceTemplates: []
+  }));
   server.server.setRequestHandler(ListPromptsRequestSchema, () => ({ prompts: [] }));
   return server;
 }
@@ -2096,7 +2205,7 @@ var SERVE_NEEDS_DATABASE = "`lurq serve` answers from a local lurq index and nee
 async function startMcpServer() {
   if (!getConfig().DATABASE_URL) throw new Error(SERVE_NEEDS_DATABASE);
   const { db, close } = createDb();
-  const server = buildMcpServer(db);
+  const server = buildMcpServer(db, { local: true });
   const shutdown = async () => {
     try {
       await close();