specguard-mcp 0.1.11 → 0.1.12

package/README.md

@@ -331,14 +331,23 @@ ask about*, which is the one question no other tool here can answer. `get_reposi
 no repository because its `sgk_…` key **is** the repository, so without this an agent can only report
 on a repository somebody already named for it.
 
-**This tool takes no arguments** — and not as an omission. The credential is the whole of the scope:
-the endpoint takes no parameters, and which repositories are in the answer is decided by SpecGuard
-from the person the key speaks for (owned, plus shared with them through a membership). A repository
-they neither own nor were given access to never enters the response, so it cannot be filtered *in*
-from this side either.
+The credential decides which repositories are *in* the answer (owned, plus shared with them
+through a membership); the three optional asks below narrow **within** that set — never around it.
+The endpoint has served them since SpecGuard's SPGD-940 (`ef6236d`), composed through the same
+`RepositoryNarrowing` concern the web grid reads, and this tool forwards them rather than
+re-deriving them. A repository the person neither owns nor was given access to never enters the
+response, so no ask can filter it *in* either. A blank value is no ask: passing an empty string
+and omitting the argument make the identical request.
+
+| argument | |
+| --- | --- |
+| `q` | keep only repositories whose `full_name` (`org/repo`) contains this substring, case-insensitively. A plain substring, not a pattern — the LIKE wildcards `%`/`_` are escaped server-side, so `org/my_repo` matches itself. A match-less ask is an empty list, not an error |
+| `role` | `"owned"` or `"shared"` — one half of the list's mix: the repositories this person owns, or the ones shared with them. Mind the spelling: the *ask* values are `owned`/`shared`, while each entry's `role` field reads `owner`/`member` — `role: "owner"` is not a valid ask and settles to no ask (full list, no error) |
+| `sort` | `"stale"` — re-order stalest-first: repositories CI has never ingested a run for first, then least-recently-ingested, with `full_name` breaking ties so two calls agree element for element. The same entries, a different order; the default order stays `full_name` ascending |
 
 The body comes back as SpecGuard serves it — `{"repositories": […]}`, each entry carrying `id`,
-`full_name`, `name`, `registered_at` and `role`, ordered by `full_name` ascending. The first four are
+`full_name`, `name`, `registered_at` and `role`, ordered by `full_name` ascending unless `sort`
+asks otherwise. The first four are
 deliberately the same four fields, under the same names, that `get_repository_overview` serves in its
 own `repository` block, so a client that reads one reads the other. `role` is `owner` or `member`:
 the list mixes repositories this person owns with repositories somebody shared with them, and nothing

package/dist/src/tools/list-repositories.d.ts

@@ -39,14 +39,41 @@ import type { ToolDefinition } from "./types.js";
  * makes a 401 or an unset variable name the one the OPERATOR of this tool has
  * to go and fix. See `config.ts`.
  *
- * == No arguments, because the credential is the whole question
+ * == The credential is the SCOPE, and the arguments narrow WITHIN it
  *
- * The endpoint takes no parameters: the person the `sgu_` key speaks for is the
- * entire scope of the answer, and `Repository.accessible_by` — owned UNION
- * shared-through-a-membership — is the platform's read-side boundary rather
- * than a filter this bridge could widen or narrow. A repository the person
- * neither owns nor is a member of never enters the response, so there is
- * nothing here for a parameter to select and nothing an argument could reach.
+ * This file first shipped argument-less on a premise that has since rotted: it
+ * said "the endpoint takes no parameters", because the person the `sgu_` key
+ * speaks for was the entire scope of the answer. That stopped being true on
+ * 2026-09-05, when specguard `ef6236d` (SPGD-940, #941) grew
+ * `GET /api/v1/repositories` three narrowing asks through the shared
+ * `RepositoryNarrowing` concern — `?q=` (case-insensitive substring on
+ * `github_full_name`, with the LIKE wildcards escaped server-side, so a
+ * literal `org/my_repo` does not widen into a pattern match), `?role=owned`
+ * and `?role=shared` (the exact partition of the accessible set into owned and
+ * shared halves), and `?sort=stale` (never-ingested repositories first, then
+ * least-recently-ingested, `github_full_name` breaking ties so the order is
+ * deterministic). The concern's own comment says the endpoint reads them "for
+ * a machine" — and this bridge IS that machine, so they are forwarded here
+ * rather than re-invented.
+ *
+ * What has NOT changed is which side of the boundary the asks sit on.
+ * `Repository.accessible_by` — owned UNION shared-through-a-membership — is
+ * still the platform's read-side boundary, and the controller chains every ask
+ * onto the relation that boundary already admitted
+ * (`narrow_repositories(authorized_repositories, …)`): a repository the person
+ * neither owns nor is a member of never ENTERS the relation, so no argument
+ * here widens the answer — it can only narrow, or re-order, what the
+ * credential already admits. Out-of-vocabulary values are the server's to
+ * clamp, not ours: an unknown `role` or `sort` settles to the no-ask, never a
+ * 400, which is also why a value that reaches the wire is passed through
+ * verbatim rather than validated against a second vocabulary here.
+ *
+ * Blank is no ask, and so is undefined: `optionalString` returns `undefined`
+ * for a blank value and `getJson` omits an `undefined` query entry, so
+ * declining an ask and omitting the argument are the same wire request — the
+ * established spelling in this codebase (`repository-overview.ts` states it
+ * as build-don't-stringify), and the reason the no-argument request below is
+ * byte-identical to the one this tool made before it had arguments at all.
  *
  * == The response is passed through, not re-modelled
  *
@@ -67,9 +94,11 @@ import type { ToolDefinition } from "./types.js";
  *
  * The order is `full_name` ascending, which the controller picks as the only
  * column a client can page or diff against without SpecGuard promising an id
- * ordering it has not designed. It is stated here for the same reason the other
- * tool states its orders: a list whose order is a coincidence and a list whose
- * order is a contract look identical in a response body.
+ * ordering it has not designed — and `?sort=stale` re-sequences exactly that
+ * loaded set rather than issuing a different query, so the entries never
+ * change, only their order does. It is stated here for the same reason the
+ * other tool states its orders: a list whose order is a coincidence and a list
+ * whose order is a contract look identical in a response body.
  */
 declare const listRepositories: ToolDefinition;
 export default listRepositories;

package/dist/src/tools/list-repositories.js

@@ -1,4 +1,5 @@
 import { getJsonObject, requireUserApiConfig } from "../support/specguard-api.js";
+import { optionalString } from "./args.js";
 /**
  * `GET /api/v1/repositories` as a tool — shipped today in the platform
  * (`specguard/config/routes.rb`, `Api::V1::UserRepositoriesController#index`).
@@ -39,14 +40,41 @@ import { getJsonObject, requireUserApiConfig } from "../support/specguard-api.js
  * makes a 401 or an unset variable name the one the OPERATOR of this tool has
  * to go and fix. See `config.ts`.
  *
- * == No arguments, because the credential is the whole question
+ * == The credential is the SCOPE, and the arguments narrow WITHIN it
  *
- * The endpoint takes no parameters: the person the `sgu_` key speaks for is the
- * entire scope of the answer, and `Repository.accessible_by` — owned UNION
- * shared-through-a-membership — is the platform's read-side boundary rather
- * than a filter this bridge could widen or narrow. A repository the person
- * neither owns nor is a member of never enters the response, so there is
- * nothing here for a parameter to select and nothing an argument could reach.
+ * This file first shipped argument-less on a premise that has since rotted: it
+ * said "the endpoint takes no parameters", because the person the `sgu_` key
+ * speaks for was the entire scope of the answer. That stopped being true on
+ * 2026-09-05, when specguard `ef6236d` (SPGD-940, #941) grew
+ * `GET /api/v1/repositories` three narrowing asks through the shared
+ * `RepositoryNarrowing` concern — `?q=` (case-insensitive substring on
+ * `github_full_name`, with the LIKE wildcards escaped server-side, so a
+ * literal `org/my_repo` does not widen into a pattern match), `?role=owned`
+ * and `?role=shared` (the exact partition of the accessible set into owned and
+ * shared halves), and `?sort=stale` (never-ingested repositories first, then
+ * least-recently-ingested, `github_full_name` breaking ties so the order is
+ * deterministic). The concern's own comment says the endpoint reads them "for
+ * a machine" — and this bridge IS that machine, so they are forwarded here
+ * rather than re-invented.
+ *
+ * What has NOT changed is which side of the boundary the asks sit on.
+ * `Repository.accessible_by` — owned UNION shared-through-a-membership — is
+ * still the platform's read-side boundary, and the controller chains every ask
+ * onto the relation that boundary already admitted
+ * (`narrow_repositories(authorized_repositories, …)`): a repository the person
+ * neither owns nor is a member of never ENTERS the relation, so no argument
+ * here widens the answer — it can only narrow, or re-order, what the
+ * credential already admits. Out-of-vocabulary values are the server's to
+ * clamp, not ours: an unknown `role` or `sort` settles to the no-ask, never a
+ * 400, which is also why a value that reaches the wire is passed through
+ * verbatim rather than validated against a second vocabulary here.
+ *
+ * Blank is no ask, and so is undefined: `optionalString` returns `undefined`
+ * for a blank value and `getJson` omits an `undefined` query entry, so
+ * declining an ask and omitting the argument are the same wire request — the
+ * established spelling in this codebase (`repository-overview.ts` states it
+ * as build-don't-stringify), and the reason the no-argument request below is
+ * byte-identical to the one this tool made before it had arguments at all.
  *
  * == The response is passed through, not re-modelled
  *
@@ -67,9 +95,11 @@ import { getJsonObject, requireUserApiConfig } from "../support/specguard-api.js
  *
  * The order is `full_name` ascending, which the controller picks as the only
  * column a client can page or diff against without SpecGuard promising an id
- * ordering it has not designed. It is stated here for the same reason the other
- * tool states its orders: a list whose order is a coincidence and a list whose
- * order is a contract look identical in a response body.
+ * ordering it has not designed — and `?sort=stale` re-sequences exactly that
+ * loaded set rather than issuing a different query, so the entries never
+ * change, only their order does. It is stated here for the same reason the
+ * other tool states its orders: a list whose order is a coincidence and a list
+ * whose order is a contract look identical in a response body.
  */
 const listRepositories = {
     name: "list_repositories",
@@ -82,7 +112,14 @@ const listRepositories = {
         "`role` is `owner` or `member`: the list mixes repositories this person owns with " +
         "repositories somebody shared with them, and nothing else distinguishes the two — read it " +
         "before assuming a repository is yours to administer. " +
-        "Ordered by `full_name` ascending, which is stable across calls. " +
+        "Three optional asks narrow WITHIN that set — none of them can widen it — all optional, " +
+        "composable on one call: `q` (case-insensitive substring on `full_name`), " +
+        "`role: \"owned\"` or `\"shared\"` (one half of the owned/shared mix — note the ask is " +
+        "spelled `owned`, not the response field's `owner`), and `sort: \"stale\"` (repositories " +
+        "CI has never ingested a run for first, then least-recently-ingested, `full_name` " +
+        "breaking ties). Omit them all and the request is the plain full list. " +
+        "Ordered by `full_name` ascending unless `sort` asks otherwise, and stable across calls " +
+        "either way. " +
         "The set is exactly what this person may see — a repository they neither own nor were given " +
         "access to is absent rather than filtered, so an empty list means no access, never an error. " +
         "Needs SPECGUARD_USER_API_KEY (an sgu_… key), which is a DIFFERENT credential from the " +
@@ -90,18 +127,77 @@ const listRepositories = {
         "place.",
     inputSchema: {
         type: "object",
-        // No properties, deliberately — see this file's header. Still CLOSED rather
-        // than merely empty: `additionalProperties: false` is advertised in
-        // `tools/list`, so a client that honours the schema REJECTS an invented
+        properties: {
+            q: {
+                type: "string",
+                description: "Keep only the repositories whose `github_full_name` (`org/repo`) CONTAINS this " +
+                    "substring, case-insensitively — the same ask the deployment's web grid reads. " +
+                    "A plain substring, not a pattern: the server matches with `ILIKE '%…%'` and escapes " +
+                    "the LIKE wildcards (`%`, `_`, `\\`) first, so `org/my_repo` matches itself rather " +
+                    "than widening into `my-repo` and `myxrepo`. " +
+                    "It narrows the SAME set the plain call serves — a repository the credential does not " +
+                    "admit never enters the response, so no `q` can make one appear — and an ask that " +
+                    "matches nothing is an empty list with a 200, the same answer as having no access, " +
+                    "not an error. " +
+                    "Blank (or null) is no ask: the request is then byte-identical to omitting the " +
+                    "argument.",
+            },
+            role: {
+                type: "string",
+                enum: ["owned", "shared"],
+                description: "Keep only ONE half of the list's mix: `owned` keeps the repositories this person " +
+                    "owns, `shared` keeps the ones somebody shared with them. The two partition the " +
+                    "accessible set exactly — a repository owned AND shared cannot exist by construction, " +
+                    "so nothing is lost by asking for one half — and both chain onto the credential " +
+                    "boundary, so neither half can be wider than the plain call's answer. " +
+                    "THE ASK VALUES ARE SPELLED DIFFERENTLY FROM THE RESPONSE FIELD: an entry's `role` is " +
+                    "`\"owner\"` or `\"member\"`, but the ask is `owned`/`shared` — send `role: " +
+                    "\"owner\"` and you are not asking for anything. A client that honours this schema " +
+                    "cannot send it (the enum refuses it before the call); a client that bypasses the " +
+                    "schema gets the server's clamp, where any value outside `owned`/`shared` settles to " +
+                    "the no-ask and the full list is served — never an error. " +
+                    "Blank (or null) is no ask: byte-identical to omitting the argument.",
+            },
+            sort: {
+                type: "string",
+                enum: ["stale"],
+                description: "Re-order the list stalest-first. The default order is `full_name` ascending, which " +
+                    "is stable across calls but says nothing about what needs attention; `stale` puts " +
+                    "the repositories CI has NEVER ingested a run for FIRST (never-ingested is the " +
+                    "stalest state on this list, not a zero), then least-recently-ingested, newest last, " +
+                    "with `github_full_name` breaking ties so two calls with the same data agree element " +
+                    "for element. " +
+                    "It re-sequences the loaded set rather than issuing a different query: the same " +
+                    "entries, a different order. `stale` is the only ordering the endpoint names — there " +
+                    "is deliberately no word for the default, because omitting the argument already " +
+                    "means it. " +
+                    "Any other value a schema-bypassing client sends settles to the server's no-ask clamp " +
+                    "(default order, no error); blank (or null) is no ask, byte-identical to omitting the " +
+                    "argument.",
+            },
+        },
+        // Still CLOSED rather than open: `additionalProperties: false` is advertised
+        // in `tools/list`, so a client that honours the schema REJECTS an invented
         // argument before the call is made. Nothing on this side refuses it —
-        // `server.ts` forwards `arguments` unvalidated and `run` ignores them — so
-        // an open schema would have the argument silently dropped and the call
-        // answered as if it had been honoured.
+        // `server.ts` forwards `arguments` unvalidated — so an open schema would
+        // have the argument silently dropped and the call answered as if it had
+        // been honoured. The enum vocabularies above are the server's own accepted
+        // values (`RepositoryNarrowing`'s ROLES and SORTS), not a second list this
+        // bridge keeps in step by hand.
         additionalProperties: false,
     },
-    async run(_args, context) {
+    async run(args, context) {
+        const q = optionalString(args["q"], "q");
+        const role = optionalString(args["role"], "role");
+        const sort = optionalString(args["sort"], "sort");
         const api = requireUserApiConfig(context.config);
-        const listing = await getJsonObject(api, "/api/v1/repositories", {}, context.fetch);
+        // Built, not stringified — the established rule for a query object
+        // (`repository-overview.ts`): `getJson` omits an `undefined` entry and sets
+        // everything else verbatim, so an ask declined (blank), omitted, or never
+        // defined all compose to the ONE request the caller meant, and with no asks
+        // at all the object is `{}` — the byte-identical request this tool made
+        // before it had arguments.
+        const listing = await getJsonObject(api, "/api/v1/repositories", { q, role, sort }, context.fetch);
         return {
             text: JSON.stringify(listing, null, 2),
             structured: listing,

package/dist/src/tools/list-repositories.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-repositories.js","sourceRoot":"","sources":["../../../src/tools/list-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AACH,MAAM,gBAAgB,GAAmB;IACvC,IAAI,EAAE,mBAAmB;IACzB,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EACT,2FAA2F;QAC3F,2FAA2F;QAC3F,6DAA6D;QAC7D,6FAA6F;QAC7F,wDAAwD;QACxD,mFAAmF;QACnF,2FAA2F;QAC3F,uDAAuD;QACvD,kEAAkE;QAClE,6FAA6F;QAC7F,8FAA8F;QAC9F,wFAAwF;QACxF,4FAA4F;QAC5F,QAAQ;IACV,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,4EAA4E;QAC5E,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,2EAA2E;QAC3E,uEAAuE;QACvE,uCAAuC;QACvC,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO;QACtB,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAEpF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"list-repositories.js","sourceRoot":"","sources":["../../../src/tools/list-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoGG;AACH,MAAM,gBAAgB,GAAmB;IACvC,IAAI,EAAE,mBAAmB;IACzB,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EACT,2FAA2F;QAC3F,2FAA2F;QAC3F,6DAA6D;QAC7D,6FAA6F;QAC7F,wDAAwD;QACxD,mFAAmF;QACnF,2FAA2F;QAC3F,uDAAuD;QACvD,yFAAyF;QACzF,2EAA2E;QAC3E,wFAAwF;QACxF,0FAA0F;QAC1F,mFAAmF;QACnF,wEAAwE;QACxE,yFAAyF;QACzF,cAAc;QACd,6FAA6F;QAC7F,8FAA8F;QAC9F,wFAAwF;QACxF,4FAA4F;QAC5F,QAAQ;IACV,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,CAAC,EAAE;gBACD,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iFAAiF;oBACjF,gFAAgF;oBAChF,sFAAsF;oBACtF,oFAAoF;oBACpF,8CAA8C;oBAC9C,uFAAuF;oBACvF,mFAAmF;oBACnF,oFAAoF;oBACpF,gBAAgB;oBAChB,gFAAgF;oBAChF,WAAW;aACd;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;gBACzB,WAAW,EACT,mFAAmF;oBACnF,iFAAiF;oBACjF,uFAAuF;oBACvF,iFAAiF;oBACjF,uEAAuE;oBACvE,uFAAuF;oBACvF,6EAA6E;oBAC7E,oFAAoF;oBACpF,mFAAmF;oBACnF,sFAAsF;oBACtF,2DAA2D;oBAC3D,qEAAqE;aACxE;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,OAAO,CAAC;gBACf,WAAW,EACT,qFAAqF;oBACrF,mFAAmF;oBACnF,gFAAgF;oBAChF,sFAAsF;oBACtF,sFAAsF;oBACtF,eAAe;oBACf,iFAAiF;oBACjF,sFAAsF;oBACtF,iFAAiF;oBACjF,YAAY;oBACZ,uFAAuF;oBACvF,uFAAuF;oBACvF,WAAW;aACd;SACF;QACD,6EAA6E;QAC7E,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,gCAAgC;QAChC,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;QACrB,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,mEAAmE;QACnE,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,wEAAwE;QACxE,2BAA2B;QAC3B,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,GAAG,EACH,sBAAsB,EACtB,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EACjB,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/dist/src/tools/registrable-repositories.d.ts

@@ -42,10 +42,15 @@ import type { ToolDefinition } from "./types.js";
  * ago" is a different fact from "you never had one", and the tool description
  * is where an agent learns to branch on it.
  *
- * == No arguments, for the same reason `list_repositories` has none
+ * == No arguments, for the same reason `list_repositories` used to have none
  *
  * The credential is the whole of the scope. The endpoint takes no parameters,
- * and nothing an argument could select reaches this answer.
+ * and nothing an argument could select reaches this answer. (`list_repositories`
+ * argued the same way and argued it the same amount — until its endpoint grew
+ * the SPGD-940 narrowing asks and the tool grew the arguments that forward
+ * them. This endpoint has grown no asks, so the argument-less shape here is
+ * still the honest one, and the sentence above keeps saying so rather than
+ * inheriting a reason that moved.)
  */
 declare const registrableRepositories: ToolDefinition;
 export default registrableRepositories;

package/dist/src/tools/registrable-repositories.js

@@ -42,10 +42,15 @@ import { getJsonObject, requireUserApiConfig } from "../support/specguard-api.js
  * ago" is a different fact from "you never had one", and the tool description
  * is where an agent learns to branch on it.
  *
- * == No arguments, for the same reason `list_repositories` has none
+ * == No arguments, for the same reason `list_repositories` used to have none
  *
  * The credential is the whole of the scope. The endpoint takes no parameters,
- * and nothing an argument could select reaches this answer.
+ * and nothing an argument could select reaches this answer. (`list_repositories`
+ * argued the same way and argued it the same amount — until its endpoint grew
+ * the SPGD-940 narrowing asks and the tool grew the arguments that forward
+ * them. This endpoint has grown no asks, so the argument-less shape here is
+ * still the honest one, and the sentence above keeps saying so rather than
+ * inheriting a reason that moved.)
  */
 const registrableRepositories = {
     name: "registrable_repositories",

package/dist/src/tools/registrable-repositories.js.map

@@ -1 +1 @@
-{"version":3,"file":"registrable-repositories.js","sourceRoot":"","sources":["../../../src/tools/registrable-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,uBAAuB,GAAmB;IAC9C,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,4FAA4F;QAC5F,2FAA2F;QAC3F,sFAAsF;QACtF,6FAA6F;QAC7F,qFAAqF;QACrF,6FAA6F;QAC7F,yFAAyF;QACzF,mFAAmF;QACnF,8FAA8F;QAC9F,yFAAyF;QACzF,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,wFAAwF;QACxF,4FAA4F;QAC5F,yFAAyF;QACzF,mFAAmF;QACnF,wFAAwF;QACxF,sFAAsF;QACtF,6EAA6E;IAC/E,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,4CAA4C;QAC5C,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO;QACtB,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,GAAG,EACH,kCAAkC,EAClC,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
+{"version":3,"file":"registrable-repositories.js","sourceRoot":"","sources":["../../../src/tools/registrable-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGlF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,uBAAuB,GAAmB;IAC9C,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,0BAA0B;IACjC,WAAW,EACT,4FAA4F;QAC5F,2FAA2F;QAC3F,sFAAsF;QACtF,6FAA6F;QAC7F,qFAAqF;QACrF,6FAA6F;QAC7F,yFAAyF;QACzF,mFAAmF;QACnF,8FAA8F;QAC9F,yFAAyF;QACzF,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,wFAAwF;QACxF,4FAA4F;QAC5F,yFAAyF;QACzF,mFAAmF;QACnF,wFAAwF;QACxF,sFAAsF;QACtF,6EAA6E;IAC/E,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,4CAA4C;QAC5C,oBAAoB,EAAE,KAAK;KAC5B;IAED,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO;QACtB,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,GAAG,EACH,kCAAkC,EAClC,EAAE,EACF,OAAO,CAAC,KAAK,CACd,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,UAAU,EAAE,OAAO;SACpB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specguard-mcp",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "MCP server exposing SpecGuard suite intelligence to AI coding agents",
   "license": "ISC",
   "type": "module",